I'm trying to learn techniques used in malware development.

Dexphot's advanced techniques, such as the use of fileless execution, polymorphic techniques, and smart and redundant boot persistence mechanisms. source

I was searching for the term "redundant boot persistence mechanism", but couldn't find anything useful.

  • That doesn't seem like a infosec term – yeah_well Feb 29 '20 at 10:12
  • "redundant" = multiple options, "boot" = computer start up, "persistence" = stays in the system even if you try to remove it. So, multiple ways to start up with the computer even if you try to get rid of it. This is more about The English words they used than about a specific security term. – schroeder Feb 29 '20 at 10:49
  • @schroeder that explains why i couldn't find the term elsewhere.. so its just a little program that starts up when booting the pc/server and persists on the system so you can't remove it (in a timely manner) so that it wont start when booting? – Hexdump Feb 29 '20 at 11:17
  • Basically. If you just had a single malware that ran, but when you rebooted, you would have to run it again (just like all programs on a computer), then the malware is very limited. Like if you infected calc.exe. The malware would only run when you ran calc.exe. But, if you can get into the boot sequence, then it always runs, and if you can get into multiple places in the boot sequence, then you can survive even when someone tries to remove it. – schroeder Feb 29 '20 at 13:20

Once malware infects a system, it looks to stay there even after interruptions that might cut off its access. This behavior is known as persistence. The underlying details of how the malware achieves persistence is known as the malware's persistence mechanism.

For example, without boot persistence, the malware would simply die and cease to function after a computer reboot which would kill the malware process, so the malware needs a way to automatically start up each time the computer is turned on. That way, the malware doesn't require the user to explicitly run the malicious file each time to re-infect the system.

To achieve this, malware oftentimes uses the same exact techniques that legitimate software does when it wants to automatically start up (software such as software updaters, notifiers, services, drivers, etc.). The most common technique would be to create a run key that references the malicious executable.

From https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys?redirectedfrom=MSDN:

Run and RunOnce registry keys cause programs to run each time that a user logs on. The data value for a key is a command line. Register programs to run by adding entries of the form description-string=commandline. You can write multiple entries under a key. If more than one program is registered under any particular key, the order in which those programs run is indeterminate.

The Windows registry includes the following four keys:


Keep in mind, there are other ways of achieving boot persistence, and there are many other run key locations, some of which require more privileges and are system-wide. With administrator privileges, the malware could register itself in the HKLM hive rather than the HKCU hive, so the malware could automatically start up each time regardless of the user logging in.

Anyway, to answer your exact question, when the source says that Dexphot utilizes "redundant boot persistence mechanisms", they most likely mean that the malware has multiple boot persistence mechanisms that act as fail-safes, so even if one of the persistence mechanisms fails or stops working for whatever reason (e.g., a run key referencing the malware is deleted), the malware can still remain persistent and automatically start up when you reboot your computer.


You could see there're lots of known Windows automatic startup/autorun/autostart locations from the following article: https://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ and the series Beyond good ol’ Run key’: http://www.hexacorn.com/blog/2017/01/28/beyond-good-ol-run-key-all-parts/

Remember that there're other unknown/not-public-yet automatic startup/autorun/autostart locations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.