45ac4276-741b-4e22-92bd-bb97042ed4bb
bootmgfw.efi
Description
This was provided by Microsoft and revoked May-23
This download link contains the Revoked Bootloader!
Commands
bcdedit /copy "{current}" /d "TheBoots" | {% if ($_ -match '{\S+}') { bcdedit /set $matches[0] path \windows\temp\bootmgfw.efi } }
Use Case | Privileges | Operating System |
---|---|---|
Persistence | 32-bit ARM |
Detections
YARA 🏹
Expand
with header and size limitation
without header and size limitation
for renamed bootloader files
Resources
CVE
Known Vulnerable Samples
Property | Value |
---|---|
Filename | bootmgfw.efi |
MD5 | |
SHA1 | |
SHA256 | 0CCF098A0B3F109F35C763E69DFA54190365999A78707EF63863A812C1C07F9C |
Authentihash MD5 | |
Authentihash SHA1 | |
Authentihash SHA256 | 1F535987EA7386DF6BFE75F51EFD35E4D2DA4B002DCA2999C0CB4B767BAFAFFD |
Imports
Expand
Imports
Expand
ImportedFunctions
Expand
ExportedFunctions
Expand
Signature
Expand
last_updated: 2023-08-31