Overview
overview
3Static
static
3Rootkits a... ).pdf
windows7-x64
1Rootkits a... ).pdf
windows10-2004-x64
1Rootkits a... ).pdf
android-9-x86
Rootkits a... ).pdf
android-10-x64
Rootkits a... ).pdf
android-11-x64
Rootkits a... ).pdf
macos-10.15-amd64
1Rootkits a... ).pdf
ubuntu-18.04-amd64
Rootkits a... ).pdf
debian-9-armhf
Rootkits a... ).pdf
debian-9-mips
Rootkits a... ).pdf
debian-9-mipsel
Behavioral task
behavioral1
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral4
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
android-x64-20240221-en
Behavioral task
behavioral5
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral6
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
macos-20240410-en
Behavioral task
behavioral7
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
ubuntu1804-amd64-20240418-en
Behavioral task
behavioral8
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral9
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral10
Sample
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
Resource
debian9-mipsel-20240418-en
General
-
Target
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf
-
Size
15.3MB
-
MD5
717ac907d6d57c3adff61bb83cc76d1f
-
SHA1
632a74b4a9253f701687bfbe6865b2ec1179fb68
-
SHA256
cebbe5c29bf3387699f4c120aec9d1d93e36389cc3b75f6b2f831adb7884914a
-
SHA512
abed70453142faaaf427bdaf6c854f138377762ae162814feee7ae1ad2d201f0cfbac289900c1f58c640138c819c6e9efb8c40a1301dc613ada260d55e050ac0
-
SSDEEP
196608:xMVH2KMJNIv9UV1dnI+5M+YW9sJnxUHYJZdTQU0yztsRJV7vHY:ycKiaSVI+e+YWicOftsJk
Malware Config
Signatures
Files
-
Rootkits and Bootkits Reversing Modern Malware and Next Generation Threats ( PDFDrive ).pdf.pdf
-
http://................................................xxx
-
http://..............................................xxx
-
http://.ccc.de/congress/2014/Fahrplan/events/6128.htmlLightEater,
-
http://.cert.org/vuls/id/976132/Thunderstrike,
-
http://.cr4.sh/2016/06/exploring-and
-
http://.intel.com/content/www/us/en/chipsets/200-series-chipset-pch-datasheet-vol-2.html
-
http://.microsoft.com
-
http://.virusbulletin.com/virusbulletin/2011/10/new-bios-rootkit-spreads-china/
-
http://.welivesecurity.com/wp-content/media_
-
http://.welivesecurity.com/wp-content/uploads/2013/04/gapz-bootkit-whitepaper.pdf.
-
http://.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdfBIOS
-
http://.youtube.com/watch?v=nyW3eTobXAI
-
http://036ashrom.org/Flashrom
-
http://037.org
-
http://037.org/sites/default/
-
http://037_windows_persistent.zip
-
http://037les.zip
-
http://037rmware.intel.com/sites/default/
-
http://12-3.int
-
http://2012azcgnfsmf.com
-
http://2012bzcfnfsif.com
-
http://2012dzcxifsff.com
-
http://2012fzcbihskf.com
-
http://2012pzcaihszf.com
-
http://2015.zeronights.org/assets/files/10-Matrosov.pdf
-
http://231www.nostarch.com
-
http://5-4.jmp
-
http://Drive.bt
-
http://MBRpartition0.data
-
http://blog.cr4.sh/2015/07/building-reliable-smm-backdoor-for-ue
-
http://blog.cr4.sh/2015/07/building-reliable-smm-backdoor-for-uefi.html
-
http://blog.cr4.sh/2016/06/exploring-and-exploiting-lenovo.html
-
http://blogs.360.cn/post/oldboot-the-first-bootkit-on-android.html
-
http://bochs.sourceforge.net
-
http://bochs.sourceforge.net/doc/docbook/user/internal-debugger.html
-
http://bochs.sourceforge.net/doc/docbook/user/internal-debugger.html.
-
http://breakpoint.info
-
http://c7zero.info/stuff/Windows8SecureBoot_Bulygin-Furtak-Bazhniuk_BHUSA2013.pdf
-
http://c7zero.info/stuff/Windows8SecureBoot_Bulygin-Furtak-Bazhniuk_BHUSA2013.pdfImplementation
-
http://chipsec_main.py
-
http://chipsec_util.py
-
http://conference.hitb.org/hitbsecconf2009dubai/materials/D2T2%20-%20Vipin%20and%20Nitin%20Kumar%20-%20vbootkit%202.0.pdf
-
http://correctly.int
-
http://data.rsrc.text.data
-
http://database.save
-
http://disk_image_file.seek
-
http://dl.acm.org/citation.cfm?id=1460892
-
http://download.eset.com/special/ESETHfsReader.exe
-
http://download.eset.com/special/ESETHfsReader.exe/
-
http://downloads.ninjacon.net/downloads/proceedings/2011/Ettlinger_Viehboeck-Evil_Core_Bootkit.pdf.4.
-
http://dropper.name
-
http://generator.do
-
http://ho.ax/downloads/De_Mysteriis_Dom_Jobsivs_Black_Hat_Slides.pdf
-
http://idaapi.do
-
http://krebsonsecurity.com/2011/06/
-
http://legbacore.com/Research_
-
http://legbacore.com/Research_files/ts2-blackhat.pdf
-
http://li.read
-
http://li.seek
-
http://loader.rsrc.text.data
-
http://mbr.py
-
http://mbr_file.read
-
http://nostarch.com
-
http://partition0.data
-
http://path_to_the_script_file.py
-
http://phrack.org/issues/65/7.html
-
http://phrack.org/issues/65/7.htmlBIOS
-
http://phrack.org/issues/65/7.htmlSMM
-
http://prompt.lb
-
http://s3bootscript.py
-
http://static1.esetstatic.com/us/resources/white-papers/TDL3-Analysis.pdf
-
http://systems.mainUnknown.build
-
http://vbr_file.read
-
http://www.c7zero.info/stuff/DEFCON22
-
http://www.c7zero.info/stuff/DEFCON22-BIOSAttacks.pdf
-
http://www.devttys0.com/tools/
-
http://www.ekoparty.org//archive/2011/ekoparty2011_Economou-Luksenberg_Deep_Boot.pdf
-
http://www.ekoparty.org//archive/2011/ekoparty2011_Economou-Luksenberg_Deep_Boot.pdf.5.
-
http://www.ftdichip.com/Support/Documents/DataSheets/Modules/DS
-
http://www.intel.com/content/www/us/en/processors/architectures
-
http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html
-
http://www.kb.cert.org/vuls/id/507496/
-
http://www.nostarch.com
-
http://www.nostarch.com/rootkits
-
http://www.syssec-project.eu/m/page-media/3/acsac13_zaddach.pdf
-
http://www.time.windows.com
-
http://www.uninformed.org/?v=1&a=5&t=pdf
-
http://www.uninformed.org/?v=1&a=5&t=pdf;
-
http://www.uninformed.org/?v=4&a=4&t=pdf
-
http://www.uninformed.org/?v=4&a=4&t=pdf.
-
http://www.update.microsoft.com
-
http://www.welivesecurity.com/wp-content/media_
-
http://www.welivesecurity.com/wp-content/uploads/2013/05/gapz-bootkit-whitepaper.pdf.7.
-
https://arstechnica.com/information-technology/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-air-gaps/x86
-
https://arstechnica.com/information-technology/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/
-
https://bit.ly/2HxeCUS
-
https://bit.ly/2ucc2vU
-
https://blogs.technet.microsoft.com/markrussinovich/2005/10/31/sony-rootkits-and-digital-rights
-
https://blogs.technet.microsoft.com/markrussinovich/2005/10/31/sony-rootkits-and-digital-rights-management-gone-too-far/
-
https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-
-
https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/
-
https://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Sebastien%20Kaczmarek%20-%20Dreamboot%20UEFI%20Bootkit.pdf
-
https://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Sebastien%20Kaczmarek%20-%20Dreamboot%20UEFI%20Bootkit.pdf.8.
-
https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/storage-device-stacks--storage-volumes--and-
-
https://docs.microsoft.com/en-us/windows/desktop/power/system-power-states
-
https://docs.microsoft.com/en-us/windows/desktop/power/system-power-states/.The
-
https://fahrplan.events.ccc.de/congress/2014/Fahrplan/events/6128.html
-
https://firmware.intel.com/sites/default/files/A_Tour_Beyond_BIOS_Implementing_S3_resume_with_EDKII.pdf
-
https://flashrom.org
-
https://github.com/AaLl86/retroware/tree/master/MemoryBootkit
-
https://github.com/Cr4sh/PeiBackdoor/
-
https://github.com/Cr4sh/UEFI_boot_script_expl
-
https://github.com/Cr4sh/UEFI_boot_script_expl/
-
https://github.com/LongSoft/UEFITool
-
https://github.com/LongSoft/UEFITool/
-
https://github.com/airbus-seclab/warbirdvm
-
https://github.com/airbus-seclab/warbirdvm.
-
https://github.com/chipsec/
-
https://github.com/chipsec/chipsec
-
https://github.com/chipsec/chipsec/.
-
https://github.com/chipsec/chipsec/blob/master/chipsec-manual.pdf
-
https://github.com/chipsec/chipsec/blob/master/chipsec/modules/common/bios_wp.py
-
https://github.com/openssl/openssl/,
-
https://github.com/pinczakko/BIOS-Disassembly-Ninjutsu-Uncovered
-
https://github.com/tianocore/edk2
-
https://github.com/tianocore/edk2/
-
https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptExecute.c
-
https://github.com/tianocore/edk2/blob/master/MdePkg/Library/SmmMemLib/SmmMemLib.c
-
https://github.com/tianocore/edk2/tree/master/MdeModulePkg/Library/PiDxeS3BootScriptLib/
-
https://github.com/xoreaxeaxeax/sinkhole
-
https://github.com/xoreaxeaxeax/sinkhole/
-
https://grsecurity.net/~spender/exploits/exploit2.txt
-
https://grsecurity.net/~spender/exploits/exploit2.txt.If
-
https://invisiblethingslab.com/resources/bh09usa/Ring%20-3%20Rootkits.pdf
-
https://media.blackhat.com/bh-us-11/Miller/BH_US_11_Miller_Battery_Firmware_Public_Slides.pdf
-
https://media.blackhat.com/bh-us-12/Brie
-
https://media.blackhat.com/bh-us-12/Briefings/Branco/BH_US_12_Branco_Scientific_Academic_WP.pdf
-
https://minnowboard.org/tutorials/updating-
-
https://minnowboard.org/tutorials/updating-firmware-via-spi-flash-programmer
-
https://moxie.org/ie-ssl-chain.txt
-
https://moxie.org/ie-ssl-chain.txt.
-
https://nostarch.com/rootkits
-
https://nostarch.com/rootkits/
-
https://nostarch.com/rootkits/.
-
https://nostarch.com/rootkits/.Analyzing
-
https://nostarch.com/rootkits/.ConclusionThe
-
https://nostarch.com/rootkits/.NOTE
-
https://nostarch.com/rootkits/.mbr.mbr
-
https://papers.put.as/papers/
-
https://papers.put.as/papers/firmware/2014/SetupForFailure-syscan-v4.pdf
-
https://sourceforge.net/projects/bochs/
-
https://sourceforge.net/projects/bochs/files/bochs/
-
https://thinkpads.com/support/hmm/hmm_pdf/t540p
-
https://uefi.org/sites/default/files/resources/UEFI_Spec_2_7.pdf
-
https://web.archive.org/web/20160316225836/http://nobunkum.ru/analytics/en-tdss-botnet
-
https://web.archive.org/web/20160316225836/http://nobunkum.ru/analytics/en-tdss-botnet/.
-
https://www.blackhat.com
-
https://www.blackhat.com/docs/asia-17/materials/asia-17-Matrosov-The-UEFI-Firmware
-
https://www.blackhat.com/docs/asia-17/materials/asia-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf
-
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Com-puter-Or-Running-Unsigned-Code-In-Intel-Management-Engine.pdf
-
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine.pdf
-
https://www.blackhat.com/docs/us-15/materials/us-15-Hudson-Thunderstrike-2-Sith-Strike.pdf
-
https://www.blackhat.com/docs/us-17/thursday/us-17-Evdokimov-Intel-AMT-Stealth-Breakthrough-wp.pdf
-
https://www.blackhat.com/docs/us-17/thursday/us-17-Evdokimov-Intel-AMT-Stealth-Breakthrough-wp.pdf.
-
https://www.blackhat.com/presentations/bh-dc-07/Heasman/Paper/bh-dc-07-Heasman-WP.pdf
-
https://www.blackhat.com/presentations/bh-europe-06/
-
https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Heasman.pdf
-
https://www.coresecurity.com/corelabs-research/publications/deactivate-rootkit/
-
https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html
-
https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/9-series-chipset-pch-datasheet.pdf
-
https://www.intel.com/content/www/us/en/architecture
-
https://www.intel.com/content/www/us/en/architecture-and-technology/unified-extensible-firmware-interface/efi-firmware-file-volume-specification.html
-
https://www.kb.cert.org/vuls/id/976132/
-
https://www.openssl.org/.The
-
https://www.secureauth.com/labs/publications/vga-persistent-rootkit/.6.
-
https://www.sweetscape.com
-
https://www.virusbulletin.com/virusbulletin/2011/10/new-bios-rootkit-spreads-china
-
https://www.vmware.com/pdf/desktop/ws90-using.pdf
-
https://www.vmware.com/pdf/desktop/ws90-using.pdf.
-
https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
-
https://www.welivesecurity.com/2011/01/14/sheldor-shocked/Development
-
https://www.welivesecurity.com/media_
-
https://www.welivesecurity.com/wp-content/media_files/Carberp-Evolution-and-BlackHole-public.pdf
-
https://www.welivesecurity.com/wp-content/uploads/2013/04/gapz-bootkit-whitepaper.pdf
-
https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf
-
https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf.
-
https://www.youtube
-
https://www.youtube.com/watch?v=SeZO5AYsBCw
- Show all
-