HDRoot Bootkit Analysis

Learn how hackers covertly loaded a malicious payload into Windows using a Master Boot Record based bootkit commonly called "HDRoot". We'll expose how their dropper installs the bootkit to the hard drive and how it transfers execution from pre-operating system boot code to backdoored service executables running in Windows. Additionally, we'll discuss the role of stolen certificates in the attack, how the dropper masqueraded as a legitimate Microsoft executable, the use of a packer to complicate reverse engineering, and some techniques which made digital forensic analysis easier. Finally, we'll share some techniques which could be used to detect and remediate this threat.

William Showalter Resources

Kaspersky Resources