One Day Sec

What are the key registry entries needed to trigger the Gootkit backdoor on startup?

The backdoor requires creating the registry path `HKEY_CURRENT_USER\Software\Microsoft\Ieak\GroupPolicy\PendingGPOs` with three values: `Count` (REG_DWORD set to 1), `Path1` (REG_SZ pointing to the `.inf` file path, e.g., `c:\test\test.inf`), and `Section1` (REG_SZ set to `DefaultInstall`). These entries cause `explorer.exe` to load the specified INF section at system startup. After each reboot, the registry key is cleared, so the backdoor must re-add the entries to maintain persistence.
registryHKCUPendingGPOspersistenceINF file

Browse all Q&A →