German malware general question

Question

In the case of the recent find by CCC, how exactly would the malware work? In default mode, it takes screenshots of active windows, it logs data and forwards the data for remote pickup. It is also capable of spying on Skype, and messenger conversations, and executing code on the infected machine. Would this be an example of a rootkit? How would it be installed? How would you detect such malware if AntiVirus don't pick it up.

Answer 1

From the article, here's my understanding:

The core of this malware is a dll that registers itself to start up on boot, and a kernel module that allows the dll to access kernel-level function that it would not otherwise have access to. Once running, the program listens for incoming commands; depending on the command, it can do a number of things - take a screenshot, record a screencast, etc.; most of these do not require root permissions.

Spying on skype and e-mail happens through user-level API calls - it's as simple as grabbing screenshots and recording audio from the sound card's mix bus. The resulting data is sent back, with AES encryption applied (but in a way that makes the entire encryption process useless - they use a symmetric key, which is hard-coded into the executable, and has been published by the CCC; anyone possessing this key can now easily spoof responses, with no way of checking whether they're genuine.) Another delicate detail is that since the malware mainly spies on local things - it can take a screenshot of an e-mail you're currently writing, and post it back home, regardless of whether you actually send the e-mail or delete it.

There is also a command to download and execute arbitrary code, with full administrator permissions, and this part requires root-level access (otherwise the user would be presented with the usual UAC prompt, exposing the malware).

So yes, the malware contains some kind of root kit, but most of its functionality can be achieved without it.