LoJaxMalware
LoJax is a UEFI rootkit used by APT28 to persist remote access software on targeted systems.From MITRE ATT&CK
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1014Rootkit
“In 2015, Corey Kallenberg and another researcher, Xeno Kovah, presented LightEater, a rootkit that allows to obtain critical data (encryption keys, etc.) through direct access to physical memory and page-by-page searches using signatures.”
- T1027Obfuscated Files or Information
“T1027 – Obfuscated Files or Information”
- T1105Ingress Tool Transfer
“T1105 – Ingress Tool Transfer”
- T1197BITS Jobs
“T1197 – BITS Jobs”
- T1542.001System Firmware
“T1542.001 – Pre-OS Boot: System Firmware”
- T1542.003Bootkit
“Let's hunt some bootkits”
What the reports say
1 report, newest first · the exact sentence from each-
Masters of disguise“In 2018, ESET detected and analyzed the LoJax UEFI rootkit, the first UEFI bootkit discovered by information security companies in the wild.”
Indicators in its reports
named in the reports above- 103.56.115[.]69in 1 report
- myfirewall[.]orgin 1 report
- f5b320f7e87cc6f9d02e28350bb87de6in 1 report
- dd8d3718197a10097cd72a94ed223238in 1 report
- 91a473d3711c28c3c563284dfafe926bin 1 report
- 0c136186858fd36080a7066657de81f5in 1 report
- 9f13636d5861066835ed5a79819aac28in 1 report
- fa0a874926453e452e3b6ced045d2206in 1 report
- 72c514c0b96e3a31f6f1a85d8f28403cin 1 report
- 0d386ebba1ccf1758a19fb0b25451afein 1 report
- b53880397d331c6fe3493a9ef81cd76ein 1 report
- 7b213a6ce7ab30a62e84d81d455b4deain 1 report
- a69205984849744c39cfb421d8e97b1fin 1 report
- 08ecd8068617c86d7e3a3e810b106dcein 1 report
- 89527f932188bd73572e2974f4344d46in 1 report
- 9e182d30b070bb14a8922cff4837b94din 1 report
- 61b4e0b1f14d93d7b176981964388291in 1 report
- 7908b9935479081a6e0f681ccef2fdd9in 1 report
- 3d2835c35ba789bd86620f98cbfbf08bin 1 report
- 1732357d3a0081a87d56ee1ae8b4d205in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.