Edit Publication: Sinowal: MBR rootkit never dies! (and it always brings some new clever features)

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image:
Legend:
Botnet:
Malware:
Exploit kit:
Services:
Target:
Origin:
Campaign:
Feature:
Strings:
Distribution vector:
Vulnerability:
CCProtocol:
Programming language:
Botnet/malware group:
Operation/working group:
Year:
Date:
Editor/Conference:
Link:
DOI:
Author:
Type:
Abstract:	In this short analysis paper I want to give a technical overview about one of the latest MBR rootkit updates. The sample which is going to be analyzed is dated April 2012. Bootkit Loader The bootkit part of this rootkit remain almost the same as the one that we have just seen in my previous analysis (available here). Sinowal uses the same algorithm to recover the start sector where it’s storing its loader and the main executable file – Last MBR partition sector + 1 for loader and Last MBR partition sector + 0×19 for the main rootkit driver. It hooks Int13h, then hooks BlOsLoader function from NT OS loader, and finally IoInitSystem API from Windows kernel

Free text:

Summary:

This is a minor edit

Watch this page

Navigation menu