HIDEDRV

S0135

About this malware

HIDEDRV is a rootkit used by APT28. It has been deployed along with Downdelph to execute and hide that malware.

Technique	Procedure example
T1014 Rootkit	HIDEDRV is a rootkit that hides certain operating system artifacts. ESET Sednit Part 3
T1055.001 Dynamic-link Library Injection	HIDEDRV injects a DLL for Downdelph into the explorer.exe process. ESET Sednit Part 3

None recorded.

ESET Sednit Part 3 Open source
ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.
Sekoia HideDRV Oct 2016 Open source
Rascagnères, P.. (2016, October 27). Rootkit analysis: Use case on HideDRV. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.