corpus.blog
41554 blogs · 4,504,310 posts Claim your blog
Record · corpus.blog/posts/01a0872e-ce07-7283-b976-78c6b9fc59a0

Windows Bootkits Guide

artemonsecurity.blogspot.com · published 10 May 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at artemonsecurity.blogspot.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
109
Words captured
1,235

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgClmw99hyi_O373UKT4cQNBz_BenfgPDpl4vv8KR1pxymXC6klwUjq82Y1Gc9HbWCjPpgpKMSn6SX9aVMfNyDoTvpRPe02oFvJWO1DSvn3AUtnmmIb1M28SvqaUn3492O-B5_v5PQ0I8Zl2MmE9PSYGo9s89KZgQIw2WtTP7jx25E0ZkWe3CAjgymL1jzi/s1912/wallpaper4.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTq2KcO_5PW_pj4rMbzQnQII7VVVjfDCXevyz5XF1D7S8Sencq2nHCP1BKFrFdQaYyjW_Oikiu2daZ1vGchCbUVUmakDuSUpz42r4nkuR6OAh0m6z_F71jSDed15Wyz29vOINfepdP4G9KlRH6IsqEjgCXuuCwaYyuj9QIy-8zDv1YjyDL-kqa3t-egL46/s2598/table.png
blogger.googleusercontent.com
https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-soeder.pdf?trk=article-ssr-frontend-pulse_little-text-block
blackhat.com
http://www2.gmer.net/mbr/?trk=article-ssr-frontend-pulse_little-text-block
www2.gmer.net
https://www.blackhat.com/presentations/bh-europe-07/Kumar/Presentation/bh-eu-07-kumar-apr19.pdf?trk=article-ssr-frontend-pulse_little-text-block
blackhat.com
https://archive.f-secure.com/weblog/archives/Kasslin-Florio-VB2008.pdf?trk=article-ssr-frontend-pulse_little-text-block
archive.f-secure.com
https://web.archive.org/web/20131026083019/http:/www.prevx.com/blog/119/From-Gromozon-to-Mebroot--A-Reflection-on-Rootkits-Today.html?trk=article-ssr-frontend-pulse_little-text-block
web.archive.org
https://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-sinowallnu-nl-incident/?trk=article-ssr-frontend-pulse_little-text-block
blog.fox-it.com
https://web.archive.org/web/20130705231427/http://www.saferbytes.it/2012/06/06/sinowal-mbr-rootkit-never-dies-and-it-always-brings-some-new-clever-features/?trk=article-ssr-frontend-pulse_little-text-block
web.archive.org
https://archive.f-secure.com/weblog/archives/00001393?trk=article-ssr-frontend-pulse_little-text-block
archive.f-secure.com
https://securelist.com/bootkit-the-challenge-of-2008/36235/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.kernelmode.info/forum/viewtopicfa5a.html?f=16&t=543&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.blackhat.com/presentations/bh-usa-09/KLEISSNER/BHUSA09-Kleissner-StonedBootkit-SLIDES.pdf?trk=article-ssr-frontend-pulse_little-text-block
blackhat.com
https://github.com/zhuyue1314/stoned-UEFI-bootkit?search=1&trk=article-ssr-frontend-pulse_little-text-block
github.com
https://www.kernelmode.info/forum/viewtopic51bc.html?f=16&t=151&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.kernelmode.info/forum/viewtopic227f.html?f=16&t=507&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.virusbulletin.com/uploads/pdf/conference_slides/2010/Johnson-VB2010.pdf?trk=article-ssr-frontend-pulse_little-text-block
virusbulletin.com
https://securelist.com/tdss-tdl-4/36339/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.welivesecurity.com/2011/10/18/tdl4-rebooted/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.welivesecurity.com/2012/02/02/tdl4-reloaded-purple-haze-all-in-my-brain/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://web-assets.esetstatic.com/wls/200x/white-papers/The_Evolution_of_TDL.pdf?trk=article-ssr-frontend-pulse_little-text-block
web-assets.esetstatic.com
https://www.slideshare.net/matrosov/defeating-x64-the-evolution-of-the-tdl-rootkit?trk=article-ssr-frontend-pulse_little-text-block
slideshare.net
https://web.archive.org/web/20231210203758/https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=cbf67446-35cc-4957-b42b-0a8299d487af&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments&trk=article-ssr-frontend-pulse_little-text-block
web.archive.org
https://web.archive.org/web/20130519145126/http://www.symantec.com/connect/blogs/backdoortidserv-and-x64?trk=article-ssr-frontend-pulse_little-text-block
web.archive.org
https://www.kernelmode.info/forum/viewtopicf210.html?f=16&t=19&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.welivesecurity.com/2012/10/18/olmasco-bootkit-next-circle-of-tdl4-evolution-or-not-2/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.bitdefender.com/blog/labs/tdss-bootkit-spawns-clones/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.com
https://www.kernelmode.info/forum/viewtopicf0b4.html?f=16&t=596&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://j00ru.vexillium.org/2011/10/pixieserv-out-for-public/?trk=article-ssr-frontend-pulse_little-text-block
j00ru.vexillium.org
https://www.kernelmode.info/forum/viewtopic3de0.html?f=11&t=2505&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/?trk=article-ssr-frontend-pulse_little-text-block
webroot.com
https://www.kernelmode.info/forum/viewtopic1321.html?f=16&t=1125&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://archive.f-secure.com/weblog/archives/00002101?trk=article-ssr-frontend-pulse_little-text-block
archive.f-secure.com
https://www.kernelmode.info/forum/viewtopicd975.html?f=16&t=750&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://web.archive.org/web/20231003142928/https://sudonull.com/post/163414-Analysis-of-SmitnylA-the-first-hybrid-bootkit-and-file-infection?trk=article-ssr-frontend-pulse_little-text-block
web.archive.org
https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7ebff36a-0740-415b-b820-f6e48b6af1e1&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments&trk=article-ssr-frontend-pulse_little-text-block
community.broadcom.com
https://www.techkings.org/threads/more-on-trojan-win32-popureb-dont-write-it-read-it-instead.26424/?trk=article-ssr-frontend-pulse_little-text-block
techkings.org
https://www.webroot.com/blog/2011/06/30/removing-popureb-doesnt-require-a-windows-reinstall/?trk=article-ssr-frontend-pulse_little-text-block
webroot.com
https://www.trendmicro.com/vinfo/ae/threat-encyclopedia/web-attack/107/popureb-launchpad-for-future-threats?trk=article-ssr-frontend-pulse_little-text-block
trendmicro.com
https://www.kernelmode.info/forum/viewtopic75e3.html?f=16&t=968&start=0&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.welivesecurity.com/2012/07/27/rovnix-d-the-code-injection-story/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.welivesecurity.com/2012/07/13/rovnix-bootkit-framework-updated/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.welivesecurity.com/2012/02/22/rovnix-reloaded-new-step-of-evolution/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://securelist.com/cybercriminals-switch-from-mbr-to-ntfs/29117/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.welivesecurity.com/2011/08/23/hasta-la-vista-bootkit-exploiting-the-vbr/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.bitdefender.co.uk/blog/labs/mayachok-hooks-int8-to-dodge-emulators/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.co.uk
https://blogs.iis.net/windowsserver/the-evolution-of-rovnix-private-tcp-ip-stacks?trk=article-ssr-frontend-pulse_little-text-block
blogs.iis.net
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cidox-trojan-spoofs-http-host-header-to-avoid-detection/?trk=article-ssr-frontend-pulse_little-text-block
mcafee.com
https://www.malwaretech.com/2014/05/rovnix-new-evolution.html?trk=article-ssr-frontend-pulse_little-text-block
malwaretech.com
https://www.kernelmode.info/forum/viewtopic5a58.html?f=16&t=981&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.welivesecurity.com/2011/11/21/evolution-of-win32carberp-going-deeper/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://web-assets.esetstatic.com/wls/200x/Carberp-Evolution-and-BlackHole-public.pdf?trk=article-ssr-frontend-pulse_little-text-block
web-assets.esetstatic.com
https://github.com/hryuk/Carberp/tree/master/source%20-%20absource/pro/all%20source/bootkit?trk=article-ssr-frontend-pulse_little-text-block
github.com
https://www.kernelmode.info/forum/viewtopicf82b.html?p=10206
kernelmode.info
https://securelist.com/xpaj-reversing-a-windows-x64-bootkit/36563/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.bitdefender.co.uk/blog/labs/xpaj-the-bootkit-edition/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.co.uk
https://www.kernelmode.info/forum/viewtopic5ef8.html?f=21&t=2059&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.bitdefender.co.uk/blog/labs/yurn-trojan-adds-bootkit-functionality/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.co.uk
https://www.kernelmode.info/forum/viewtopic7df6.html?f=16&t=2083&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://news.drweb.com/show/?i=2979&c=5&lng=en&p=0&trk=article-ssr-frontend-pulse_little-text-block
news.drweb.com
https://www.welivesecurity.com/2012/12/27/win32gapz-new-bootkit-technique/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.welivesecurity.com/2012/12/27/win32gapz-steps-of-evolution/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://inresearching.blogspot.com/2013/03/win32gapz-family-ring0-payload.html?trk=article-ssr-frontend-pulse_little-text-block
inresearching.blogspot.com
https://www.kernelmode.info/forum/viewtopicbc00.html?f=16&t=2306&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e?trk=article-ssr-frontend-pulse_little-text-block
linkedin.com
https://zerosecurity.org/2013/06/guntior-bootkit-upgraded/?trk=article-ssr-frontend-pulse_little-text-block
zerosecurity.org
https://www.bitdefender.co.uk/blog/labs/whistler-bootkit-flies-under-the-radar/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.co.uk
https://www.kernelmode.info/forum/viewtopicfa77.html?f=16&t=2473&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
http://asec.ahnlab.com/328?trk=article-ssr-frontend-pulse_little-text-block
asec.ahnlab.com
http://asec.ahnlab.com/5?trk=article-ssr-frontend-pulse_little-text-block
asec.ahnlab.com
https://www.kernelmode.info/forum/viewtopicfa67.html?f=16&t=2514&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.welivesecurity.com/2013/02/25/caphaw-attacking-major-european-banks-with-webinject-plugin/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.kernelmode.info/forum/viewtopic3208.html?p=18527
kernelmode.info
https://www.bitdefender.co.uk/blog/labs/plite-rootkit-spies-on-gamers/?trk=article-ssr-frontend-pulse_little-text-block
bitdefender.co.uk
https://news.drweb.ru/show/?lng=ru&i=2927&c=9&trk=article-ssr-frontend-pulse_little-text-block
news.drweb.ru
https://www.kernelmode.info/forum/viewtopic0fe5.html?f=16&t=1666&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=WinNT/Simda&threatId=&trk=article-ssr-frontend-pulse_little-text-block
microsoft.com
https://inresearching.blogspot.com/2013/07/win32simda-family-ring0-payload.html?trk=article-ssr-frontend-pulse_little-text-block
inresearching.blogspot.com
https://www.kernelmode.info/forum/viewtopice0b7.html?p=19755
kernelmode.info
https://vms.drweb.com/virus/?i=3771317&trk=article-ssr-frontend-pulse_little-text-block
vms.drweb.com
https://www.kernelmode.info/forum/viewtopicabb9.html?f=16&t=3242&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://web-assets.esetstatic.com/wls/2016/10/eset-sednit-part3.pdf?trk=article-ssr-frontend-pulse_little-text-block
web-assets.esetstatic.com
https://www.tgsoft.it/news/news_archivio.asp?id=884&trk=article-ssr-frontend-pulse_little-text-block
tgsoft.it
https://www.kernelmode.info/forum/viewtopic0dc7.html?f=16&t=3667&trk=article-ssr-frontend-pulse_little-text-block
kernelmode.info
https://github.com/hackedteam/vector-edk?trk=article-ssr-frontend-pulse_little-text-block
github.com
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://github.com/Mattiwatti/EfiGuard?trk=article-ssr-frontend-pulse_little-text-block
github.com
https://securelist.com/mosaicregressor/98849/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/07080558/MosaicRegressor_Technical-details.pdf?trk=article-ssr-frontend-pulse_little-text-block
media.kasperskycontenthub.com
https://securelist.com/finspy-unseen-findings/104322/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.binarly.io/blog/a-deeper-uefi-dive-into-moonbounce?trk=article-ssr-frontend-pulse_little-text-block
binarly.io
https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://github.com/ldpreload/BlackLotus?trk=article-ssr-frontend-pulse_little-text-block
github.com
https://www.binarly.io/blog/the-untold-story-of-the-blacklotus-uefi-bootkit?trk=article-ssr-frontend-pulse_little-text-block
binarly.io
https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/?trk=article-ssr-frontend-pulse_little-text-block
microsoft.com
https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/?trk=article-ssr-frontend-pulse_little-text-block
unit42.paloaltonetworks.com
https://www.virusbulletin.com/conference/vb2011/abstracts/modern-bootkit-trends-bypassing-kernel-mode-signing-policy/?trk=article-ssr-frontend-pulse_little-text-block
virusbulletin.com
https://www.virusbulletin.com/conference/vb2014/abstracts/bootkits-past-present-amp-future/?trk=article-ssr-frontend-pulse_little-text-block
virusbulletin.com
https://www.blackhat.com/docs/us-14/materials/us-14-Haukli-Exposing-Bootkits-With-BIOS-Emulation-WP.pdf?trk=article-ssr-frontend-pulse_little-text-block
blackhat.com
https://securelist.com/attacks-before-system-startup/63725/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.blackhat.com/docs/asia-17/materials/asia-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf?trk=article-ssr-frontend-pulse_little-text-block
blackhat.com
https://blogs.vmware.com/security/2021/06/detecting-uefi-bootkits-in-the-wild-part-1.html?trk=article-ssr-frontend-pulse_little-text-block
blogs.vmware.com
https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf?trk=article-ssr-frontend-pulse_little-text-block
eclypsium.com
https://github.com/quarkslab/dreamboot?trk=article-ssr-frontend-pulse_little-text-block
github.com
https://securelist.com/the-chinese-bootkit/29653/?trk=article-ssr-frontend-pulse_little-text-block
securelist.com
https://www.welivesecurity.com/2012/01/03/bootkit-threat-evolution-in-2011-2/?trk=article-ssr-frontend-pulse_little-text-block
welivesecurity.com
https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/
microsoft.com