0dc82e15-40ab-4a65-bfbe-9c8925d3cdbb
bootmgfw.efi
Description
This was provided by Microsoft and revoked May-23
This download link contains the Revoked Bootloader!
Commands
bcdedit /copy "{current}" /d "TheBoots" | {% if ($_ -match '{\S+}') { bcdedit /set $matches[0] path \windows\temp\bootmgfw.efi } }
Use Case | Privileges | Operating System |
---|---|---|
Persistence | 64-bit |
Detections
YARA 🏹
Expand
with header and size limitation
without header and size limitation
for renamed bootloader files
Resources
CVE
Known Vulnerable Samples
Property | Value |
---|---|
Filename | bootmgfw.efi |
MD5 | |
SHA1 | |
SHA256 | 8DEB88A2435270BD24328760FA6FB5C77BCD5C47F7A0109F15300D644CB9A228 |
Authentihash MD5 | |
Authentihash SHA1 | |
Authentihash SHA256 | DBB424CB8AD35EE68546092645C4689D6027A97FEDF3C5AF842B9572F1276997 |
Imports
Expand
Imports
Expand
ImportedFunctions
Expand
ExportedFunctions
Expand
Signature
Expand
last_updated: 2023-08-31