Komodia

Overview

Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamous for being the underlying technology behind the **'Superfish'** adware scandal, where it was discovered pre-installed on Lenovo laptops in 2015. While marketed to parental control and ad-injection companies as a way to monitor encrypted web traffic, its implementation acts exactly like a malicious rootkit and fundamentally breaks the security model of the internet on infected endpoints.

Understanding the Komodia (Superfish) Threat
To an end-user, Komodia is invisible, though they might notice unexpected advertisements appearing on secure websites like Google or their bank. For a security analyst, Komodia is a catastrophic vulnerability. To intercept encrypted HTTPS traffic, Komodia installs a self-signed root certificate authority (CA) into the Windows certificate store and acts as a local Man-in-the-Middle (MitM) proxy. The fatal flaw was that all installations of Komodia shared the *exact same private key* for this root certificate.

Execution and TLS Interception Mechanics
Komodia is typically bundled with adware (like Superfish) or aggressive parental control software (`T1189`). Upon execution, it installs a local proxy service (`T1543.003`) and reroutes all endpoint web traffic through it (`T1562.004`). Crucially, it forces the installation of its own root CA into the Trusted Root Certification Authorities store (`T1553.004`). When a user visits a secure site (like `https://bank.com`), the Komodia proxy intercepts the connection, decrypts the traffic (`T1185`), injects ads or logs the data, and then re-encrypts the connection to the browser using a dynamically generated certificate signed by its fake root CA. Because the private key was hardcoded and easily extracted, *any* attacker on the same network (e.g., a public Wi-Fi hotspot) could use that key to completely spoof any secure website, bypassing all browser security warnings.

Indicators of Compromise & Impact
The impact is the complete destruction of endpoint TLS security and the exposure of all passwords, banking details, and secure communications. The primary IoC is the presence of unauthorized root certificates in the Windows Certificate Manager (`certmgr.msc`) (specifically looking for 'Superfish, Inc.' or 'Komodia'). Network analysts will observe all HTTPS traffic originating from the endpoint being proxied through `localhost` before exiting the network.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_KOMODIA {
    meta:
        description = "Detects Komodia (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "komodia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Komodia Activity
id: fdb2b2cb37099c7ccdbe3cc673128900
status: experimental
description: Detects generic indicators of the komodia malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*komodia*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Identify and completely uninstall the software utilizing the Komodia SDK (e.g., Superfish, KeepMyFamilySecure, Kurupira).
2. CRITICAL: Uninstalling the software does NOT remove the root certificate. You must manually open `certmgr.msc` and delete the compromised root CA from the 'Trusted Root Certification Authorities' store.
3. Run Microsoft's dedicated Malicious Software Removal Tool (MSRT) or an enterprise EDR solution specifically configured to hunt and strip Komodia certificates.
4. Enforce a mandatory password reset for all accounts the user accessed while the software was active, as all HTTPS traffic was decrypted.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume uninstalling the parent adware fixes the vulnerability; the rogue root certificate remains and can be exploited by any attacker.
2. Avoid ignoring the alert; even if the software was installed 'legitimately' for parental controls, the shared private key makes the endpoint highly vulnerable to interception.

References & External Analysis

• Search "komodia" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Websearch
• 1Clickdownload
• Wronginf
• Smallhttp
• Unwaders

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/komodia.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.