arrow_back
search
close

HackTool.Win32.Hider.AA

September 10, 2019
 Analysis by: Earle Maui Earnshaw
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Hacking Tool

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

29,184 bytes

Memory Resident:

Yes

Initial Samples Received Date:

06 Sep 2019

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Hacking Tool does the following:

  • It hides the following:
    • Files
    • Directories
    • Registry Key
    • Registry Values
  • Protects specific processes
  • Exclude specific processes from hiding and protecting features
  • Accepts the following commands:
    hiddencli [mode] [connection] [perform]
    mode:

    By default perform current commands
    • /install [%driver%] → Install commands to registry without execution, driver will load them onstart. If this flag is set connection parameters shouldn't be set. Optionalparameter is used for set valid registry path if driver name is changed, by default \"hidden\"
    • /uninstall [%driver%] all → Uninstall all configs from registry. This flag is all-sufficient therefore if this flag is set no other parameters and commands should be set after

    Connection:
    • /gate <%name%> Set specific connection gate name. By default \"HiddenGate\" is used

    Perform:
    By default perform one command by one execution
    • /multi → Enable multiple commands per execution, just type commands one by one without any separator
    • /config <%path%> → Loads multiple commands from file, each command should be on separate line

    Commands:
    • /state → Enable or disable hidden
    • /query state → Get enforcement state
    • /hide <%path%> → Hide filesystem or registry object by path
    • /unhide all → Unhide all filesystem or registry object by selected type
    • /unhide <%ruleid%> → Unhide all filesystem or registry object by selected type and rule ID
    • /ignore image [inherit:] [apply:] <%path%> → Set rule that allows to see hidden filesystem and registry objects for processes with specific image path
    • /unignore <%ruleid%> → Remove rule that allows to see hidden filesystem and registry objects by rule ID
    • /unignore all → Remove all rules that allow to see hidden filesystem and registry objects
    • /ignore pid [inherit:] <%pid%> → Turn on abillity to see hidden filesystem and registry objects for specific process by PID
    • /unignore pid <%pid%> → Turn off abillity to see hidden filesystem and registry objects for specific process by PID
    • /protect image [inherit:] [apply:] <%path%> → Set rule that allows to enable process protection for processes with specific image path
    • /unprotect <%ruleid%> → Remove rule that enables process protection by rule ID
    • /unprotect all → Remove all rules that enable process protection
    • /protect pid [inherit:] <%pid%> → Turn on protection for specific process by PID
    • /unprotect pid <%pid%> → Turn off protection for specific process by PID
    • /query process <%pid%> → Query information about state of the process by PID

    Options:
    • inherit:none → Disable inheritance of protected or ignored state
    • inherit:once → Child process will inherit the same state but its children no
    • inherit:always → Child process will inherit the same state and its children too
    • apply:forall → Apply policy for existing processes and for all new processes
    • apply:fornew → Don't apply policy for existing processes only for new

  SOLUTION

Minimum Scan Engine:

9.850

SSAPI PATTERN File:

2.213.00

SSAPI PATTERN Date:

12 Sep 2019

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Scan your computer with your Trend Micro product to delete files detected as HackTool.Win32.Hider.AA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.