eEye BootRoot

[Cthulhu]

A friend of mine showed this to me today.
I searched here in the forum and I found no results: http://research.eeye.com/html/tools/RT20060801-7.html

It is a MBR Rootkit developed by eEye

It comes with source code, so I thought it was worth of sharing it with you

My best regards
Cthulhu

[dELTA]

Yep, it's a nice piece of work indeed.

[JMI]

Thanks for sharing with our readers. Many are always looking for new tricks, even the nasty kind.

Regards,

[Nico]

In the wild malwares currently use code from this POC, to infect users.

Interesting reading:

http://www2.gmer.net/mbr/

[dELTA]

Yep, I've actually been analyzing one of these malwares myself during the last weeks.

[Kayaker]

And the story continues..

http://blog.trendmicro.com/new-mbr-rootkit-variant-mbr-rootkit-vs-anti-rootkit/

[JMI]

Well, at least it is keeping all those malware detectors and analyzers fully employed.

Regards,