latebros

x64 usermode rootkit. This was a project i made (with help from Daax and JustMagic) while researching usermode rootkits. Project is neither under development nor finished.

Capabilities

• Hide process from enumeration
• Hide registry key from enumeration
• Hide file for modification
• Protect process from modification
• Protect file from modification
• Protect registry key from erasure

Hooks

• ntdll.dll!NtOpenProcess
• ntdll.dll!NtQuerySystemInformation
• ntdll.dll!NtCreateFile
• ntdll.dll!NtOpenFile
• ntdll.dll!NtQueryDirectoryFile
• ntdll.dll!NtDeleteValueKey
• ntdll.dll!NtEnumerateValueKey

Thanks to

• Daax
• JustMagic