HitmanPro operates differently than traditional Endpoint Protection Platforms (EPPs). Instead of deploying persistent local service daemons and multi-gigabyte signature databases, it utilizes a lightweight, on-demand execution model. The entire engine is contained within a single executable file of approximately 10 MB, designed to run without installation or modification to C:\Program Files\.
When initialized, HitmanPro runs in user mode but can immediately deploy a kernel-mode driver (NT service) to gain direct hardware and memory access. This allows it to bypass standard Windows API constraints.
For systems locked by ransomware or Master Boot Record (MBR) rootkits, the HitmanPro.Kickstart feature manipulates the boot configuration data via an external USB interface. It inserts its driver into the boot sequence prior to the execution of ntoskrnl.exe. This allows it to audit the system memory space before malware kernel hooks can mask the malicious payloads.
Low-Level Forensic Auditing
The local scanning phase avoids generic, sequential directory walking. Instead, the engine performs low-level structural analysis across critical system vectors:
- Direct Disk Sector Parsing: HitmanPro reads the raw sectors of the Master Boot Record (MBR) and Volume Boot Record (VBR) by issuing commands directly to the storage controller interface. This completely bypasses the Windows file system drivers (
ntfs.sys), revealing bootkits that intercept standard file system queries to hide their presence. - Kernel Hook Detection: The scanner cross-references the addresses within the System Service Descriptor Table (SSDT) against a known-good baseline. Unauthorized modifications or pointers pointing outside of the legitimate NT kernel memory space are immediately flagged as rootkit behavior.
- Volatile Memory Inspection: The engine maps active execution threads in RAM, checking for hollowed processes, reflective DLL injections, and orphaned threads running code out of unallocated memory blocks.
Behavioral and Heuristic Cluster Analysis
Before communicating with the cloud, HitmanPro evaluates files based on structural characteristics rather than exact definitions. The local engine analyzes Portable Executable (PE) headers, section attributes, and metadata layout using the following metrics:
- Code Entropy Calculations: High entropy (randomness) within the code sections of an executable indicates structural packing or encryption. While legitimate software occasionally uses packers, unknown binaries with high entropy operating out of temporary directories like
%AppData%or%Temp%are treated as highly suspicious. - Authenticode Validation: The engine verifies the digital signature chains of all running processes. Files lacking standard resource attributes (such as a valid company name, product version, or copyright string) are automatically prioritized for deeper inspection.
If a file exhibits an irregular combination of these factors, the local engine classifies it as an “unknown state” and shifts to cloud-assisted verification.
Cloud-Assisted Multi-Engine Verification
HitmanPro shifts the heavy processing required for definitive malware classification away from the local endpoint and into the Sophos Central Scan Cloud.
When an unknown binary is detected, HitmanPro does not upload the entire file immediately. Instead, it calculates a cryptographic hash ($SHA\text{-}256$) of the file. This hash is transmitted via an encrypted TLS connection to the cloud lookup infrastructure.
The Scan Cloud acts as a centralized threat intelligence aggregator. It parses the submitted hash through multiple industry-leading anti-malware definition grids simultaneously, utilizing telemetry from Sophos, Kaspersky, and Bitdefender.
- Known Threat Path: If any engine within the cloud grid matches the hash to a confirmed signature, a remediation payload is sent back to the endpoint instantly.
- Unknown Threat Path: If the hash is completely unique to the global ecosystem, the local agent is instructed to upload the file’s metadata and structural layout. The cloud then runs the file through an automated dynamic sandbox, analyzing runtime API calls and memory behavior to generate a definitive threat score.
Kernel-Level Remediation and Rollback
Once threats are identified, HitmanPro switches to its remediation subsystem, which is hardened against active malware self-defense mechanisms.
Many malware strains use “watchdog” processes that monitor system threads and instantly respawn components if they are killed. HitmanPro’s kernel driver breaks this cycle by targeting the threads at the Ring-0 layer. Rather than using standard user-mode termination commands like TerminateProcess, the driver suspends all associated execution threads simultaneously, rendering the malware dormant before any files are touched.
For files that have modified or patched essential Windows binaries (such as user32.dll or winlogon.exe), simple deletion would cause a system crash or a Blue Screen of Death (BSoD). HitmanPro addresses this by replacing the corrupted portions of the system files with pristine copies extracted from a secure OS repository.
Finally, for persistent rootkits embedded within the registry under HKLM\SYSTEM\CurrentControlSet\Services, HitmanPro schedules a native boot-time deletion script. During the subsequent system reboot, before any third-party drivers can load, the engine wipes the malicious registry entries and purges the driver binaries from the disk.
Also Read: Carbonite Automated Backup Service for Effortless Data Protection – My Tech Blaze
