Mebromi: The First BIOS Rootkit in the Wild
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Model Malware - T1587.001 Malware - T1588.001 Software - T1592.002 Tool - T1588.002 Rootkit - T1014 Rootkit
Show in Graph
Common Information
Type Value
UUID f26ae670-9feb-4014-a1d1-24a57444c846
Fingerprint acc5919ac4675f67
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 13, 2011, 6:44 a.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 13, 2024, 4:22 p.m.
Headline Mebromi: the first BIOS rootkit in the wild
Title Mebromi: The First BIOS Rootkit in the Wild
Detected Hints/Tags/Attributes 46/2/12
Source URLs
Redirection Url
Details Source https://www.webroot.com//blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
URL Provider
Details Provider Source level domain
Details webroot.com www.webroot.com
Attributes
Details Type #Events CTI Value
Details Domain 2 
dh.3515.info
Details File 1 
flash.dll
Details File 2 
cbrom.exe
Details File 3 
my.sys
Details File 2 
bios.sys
Details File 12 
beep.sys
Details File 3 
bios.bin
Details File 11 
disk.sys
Details File 212 
winlogon.exe
Details File 89 
wininit.exe
Details File 2 
3515.inf
Details Url 1 
http://dh.3515.info:806/test/91/calc