Home Malware Programs Trojans Troj/JadMbr-A

Troj/JadMbr-A

Posted: June 12, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 28
First Seen: June 12, 2013
Last Seen: April 19, 2024
OS(es) Affected: Windows

Troj/JadMbr-A is a Trojan and the malicious MBR that is related to the Chinese bootkit Guntior. Guntior, unlike other bootkits that hack the I/O path by placing hooks in the miniport driver, hooks the disk class drivers (disk.sys) IRP_MJ_READ and IRP_MJ_WRITE. This approach is not as deep as placing hooks in the miniport driver. Normally the I/O path taken for an IRP flows from the storage class driver to the port driver which then interfaces with the miniport driver and back. So the miniport driver resides closer to the hardware than the storage class driver. Bootkits place their hooks in the miniport driver to achieve maximum control. Generally, hooking at such levels is done to subvert the attempts of security software to read and write to disk through storage filter drivers. This is to conceal the malicious MBR and instead return a clean view of the MBR when read. The hooks don't actually reside inside the driver that the rootkit downloads but rather in an allocated region of kernel memory.

Loading...