Skip to content
MalwareWiki

Malware

Rovnix

aka Mayachok · Cidox · BkLoader

Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves.

Rovnix, also known as Mayachok, Cidox, BkLoader, is a Windows malware family.

Background

Rovnix is a bootkit made up of a driver loader placed in the VBR along with the 32bit and 64bit drivers it loads. Its source code surfaced as part of the Carberp leak (https://github.com/nyx0/Rovnix). It has served as a protective layer for at least Gozi ISFB, ReactorBot, and Rerdom.

Source: Malpedia (Fraunhofer FKIE).