Backboot

Overview

Rootkit:Win32/Backboot is an extremely dangerous class of malware designed to fundamentally subvert the Windows operating system at its lowest levels. By infecting the Master Boot Record (MBR) or Volume Boot Record (VBR), Backboot guarantees it executes *before* Windows itself, granting it absolute control over the system and the ability to hide entirely from standard security software.

Understanding Backboot (Bootkits)
To an end-user, a Backboot infection is completely invisible; the system boots normally. For a threat hunter, a bootkit is a nightmare scenario. Because it loads before the OS kernel, it can patch kernel memory in real-time, intercepting API calls made by antivirus software and returning falsified data. This allows it to completely hide its files, registry keys, and network connections from the OS, effectively blinding EDR solutions.

Execution and Kernel Subversion
Backboot is typically deployed as a secondary payload by a sophisticated dropper that has already gained Administrator or SYSTEM privileges. Upon execution, the malware overwrites the physical sectors of the hard drive containing the MBR/VBR (`T1542.003`). When the computer reboots, the BIOS/UEFI loads the malicious bootloader first. This bootloader patches the Windows kernel (`ntoskrnl.exe`) in memory as it loads (`T1014`), hooking critical functions (like `ZwQueryDirectoryFile` or `ZwEnumerateKey`). This allows the bootkit to create a hidden Virtual File System (VFS) to store its modules and to inject payloads directly into user-mode processes without leaving traces on the disk.

Indicators of Compromise & Impact
The impact is total and undetectable system compromise. Detection requires advanced techniques. EDR platforms may detect the initial attempt to write raw data to `\\.\PhysicalDrive0`. However, post-infection detection requires offline analysis. Booting from a clean, live USB (like WinPE) and comparing the MBR hash against a known good baseline is the definitive way to detect a bootkit, as the malware cannot intercept API calls if its host OS isn't running.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BACKBOOT {
    meta:
        description = "Detects Backboot (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "backboot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Backboot Activity
id: 545082ef0a5035cde9188c0a234948bf
status: experimental
description: Detects generic indicators of the backboot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*backboot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disconnect the machine from the network; the attacker has total control and is completely invisible to standard monitoring.
2. Do NOT attempt to use standard antivirus to clean the machine; the bootkit will simply lie to the AV scanner, reporting the system as clean.
3. Capture a full physical memory image (RAM dump) for forensic analysis of the kernel hooks and the decrypted payload.
4. The only guaranteed remediation for a bootkit is to completely wipe the hard drive (including rebuilding the MBR and partition tables) and perform a clean OS install.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust any data or scan results generated from the infected operating system.
2. Avoid simply reinstalling Windows over the existing partition; the bootkit resides outside the file system and will survive a standard reinstall.

References & External Analysis

• Search "backboot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Bhoint
• Systemcare
• Rpcdcom
• Woozlist
• Mumawow

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/backboot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.