Komodia
Table of Contents
Overview
Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamous for being the underlying technology behind the **'Superfish'** adware scandal, where it was discovered pre-installed on Lenovo laptops in 2015. While marketed to parental control and ad-injection companies as a way to monitor encrypted web traffic, its implementation acts exactly like a malicious rootkit and fundamentally breaks the security model of the internet on infected endpoints.
Understanding the Komodia (Superfish) Threat
To an end-user, Komodia is invisible, though they might notice unexpected advertisements appearing on secure websites like Google or their bank. For a security analyst, Komodia is a catastrophic vulnerability. To intercept encrypted HTTPS traffic, Komodia installs a self-signed root certificate authority (CA) into the Windows certificate store and acts as a local Man-in-the-Middle (MitM) proxy. The fatal flaw was that all installations of Komodia shared the *exact same private key* for this root certificate.
Execution and TLS Interception Mechanics
Komodia is typically bundled with adware (like Superfish) or aggressive parental control software (`T1189`). Upon execution, it installs a local proxy service (`T1543.003`) and reroutes all endpoint web traffic through it (`T1562.004`). Crucially, it forces the installation of its own root CA into the Trusted Root Certification Authorities store (`T1553.004`). When a user visits a secure site (like `https://bank.com`), the Komodia proxy intercepts the connection, decrypts the traffic (`T1185`), injects ads or logs the data, and then re-encrypts the connection to the browser using a dynamically generated certificate signed by its fake root CA. Because the private key was hardcoded and easily extracted, *any* attacker on the same network (e.g., a public Wi-Fi hotspot) could use that key to completely spoof any secure website, bypassing all browser security warnings.
Indicators of Compromise & Impact
The impact is the complete destruction of endpoint TLS security and the exposure of all passwords, banking details, and secure communications. The primary IoC is the presence of unauthorized root certificates in the Windows Certificate Manager (`certmgr.msc`) (specifically looking for 'Superfish, Inc.' or 'Komodia'). Network analysts will observe all HTTPS traffic originating from the endpoint being proxied through `localhost` before exiting the network.
MITRE ATT&CK Techniques
Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.
MITRE D3FEND™ Defensive Countermeasures
Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):
| D3FEND ID | Countermeasure Name | Tactic | Countered ATT&CK | Defensive Guidance |
|---|---|---|---|---|
D3-MitBA | Man-in-the-Browser Analysis | Detect | T1185 | Deploy browser extension whitelisting and hardware-backed session binding to prevent rogue DOM and socket injection. |
D3-SCM | Windows Service Creation Monitoring | Detect | T1543.003 | Verify service binary image signatures and restrict standard users from creating or modifying service definitions. |
D3-STA | Security Tool Anti-Tamper Enforcement | Harden | T1562.004 | Enable EDR Tamper Protection and Windows Defender Protected Process Light (PPL) to prevent service termination. |
Tiered Detection Rules (Cisco CAIRN Model)
Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:
Tier 1 Primitive Artifact Rule (Fast Triage)
Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.
rule MALWARE_WIN_KOMODIA_T1_ARTIFACT {
meta:
description = "Tier 1 Primitive Artifact: Raw string matches for Komodia"
tier = "T1 - Primitive Artifact"
confidence = "Low-Medium (Fast Triage)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
$s1 = "komodia" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Tier 2 Behavioral Context Rule (Process Chains & Sigma)
Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.
title: SystemHelpDesk Detection - Komodia (Advanced Threat) Execution & Triage
id: 7090cb88-e8db-5f08-b04e-2257f77357c4
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
with the Komodia malware family. Detects proxy execution, reflective DLL loading,
and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/komodia
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1185
- attack.t1553_004
- attack.t1562_004
- attack.t1543_003
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \powershell.exe
- \cmd.exe
- \rundll32.exe
- \regsvr32.exe
CommandLine|contains:
- DownloadString
- IEX(
- '/s /n /u /i:'
- sc create
- start-process
condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: highTier 3 Attribution Fingerprint Rule (High Fidelity)
Deep signature matching distinctive operational fingerprints and payload characteristics.
rule MALWARE_WIN_KOMODIA_T3_ATTRIBUTION {
meta:
description = "Tier 3 Attribution Fingerprint: Heuristic detection for Komodia tradecraft"
tier = "T3 - Attribution Fingerprint"
confidence = "High (Confirmed Family Signature)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
// Core family identifier & heuristic payload signatures
$attrib_str = "komodia" ascii wide nocase
$pe_magic = "MZ" ascii
$net_marker = "http" ascii nocase
condition:
uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}Containment & Response Steps
Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.
- Identify and completely uninstall the software utilizing the Komodia SDK (e.g., Superfish, KeepMyFamilySecure, Kurupira).
- CRITICAL: Uninstalling the software does NOT remove the root certificate. You must manually open `certmgr.msc` and delete the compromised root CA from the 'Trusted Root Certification Authorities' store.
- Run Microsoft's dedicated Malicious Software Removal Tool (MSRT) or an enterprise EDR solution specifically configured to hunt and strip Komodia certificates.
- Enforce a mandatory password reset for all accounts the user accessed while the software was active, as all HTTPS traffic was decrypted.
What to Avoid
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
- Do not assume uninstalling the parent adware fixes the vulnerability; the rogue root certificate remains and can be exploited by any attacker.
- Avoid ignoring the alert; even if the software was installed 'legitimately' for parental controls, the shared private key makes the endpoint highly vulnerable to interception.
References & External Analysis
- Search "komodia" on VirusTotal (External Analysis)
- Search "komodia" on Any.Run (Sandbox Sandbox)
- Search "komodia" on MalwareBazaar (Malware Samples)
Frequently Asked Questions
What is Komodia and what threat category does it belong to?
Komodia is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments.
How does Komodia establish persistence and evade defensive controls?
Komodia typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks.
What are the essential incident response steps for mitigating a Komodia compromise?
Security teams responding to Komodia should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups.
What lateral movement and credential access tactics does Komodia leverage in enterprise intrusions?
Komodia frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers.
How does Komodia maintain covert communications and evade perimeter network monitoring?
Komodia often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering.
How do I remove the Komodia Advanced_Threat from Windows?
Manual removal of Komodia is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Komodia a virus or a Advanced_Threat?
Komodia is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Komodia typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Komodia infection?
Symptoms of Komodia can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Protect Your Network Against Advanced_Threats
Want to prevent Komodia and similar threats from compromising your organization? Read our comprehensive defensive guide: Think You've Been Hacked? What To Do First.
📣 Threat Intel Correction or Update?
Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.
Machine-readable
Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/komodia.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.