Guntior - the story of an advanced bootkit that doesn't rely on…

216.73.217.22

Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers

· Published 08/05/2024 13:32 · Modified 08/05/2024 17:29

Essential information

Published: 08/05/2024 13:32
Modified: 08/05/2024 17:29
Tags: 2024-05-03 2024-05-04 2024-05-05 2024-05-06 2024-05-07 2024-05-08 ata bus dll path explorer findwindow guntior ime file ioctl mbr mebroot ntfs payload dll rootkit rovnix tdl4 tidserv windows
Related entities: 6 observables, 9 techniques (mitre), 1 malware

Description

Amid the rise of bootkits at the time, a dropper was captured in-the-wild and posted on a malware tracker. The malware was called "Guntior", named after the device object its authors had chosen for it (\Device\Guntior). The name also appears in AV detections.

External references

https://artemonsecurity.blogspot.com/
https://otx.alienvault.com/pulse/663b7ee697d3654bee3cbf0e

Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers

Essential information

Description

Related entities

Observables (6)

Techniques (MITRE) (9)

Malware (1)

External references