[ForgeSMTP]

So my buddy's PC got hacked by a Russian hacker few weeks ago and ever since he's been trying to take out the malware. At first, we both found out that the windows MoUsoCoreWorker.exe was infected and a fake service was created at a different path instead of C:/Windows/System32/MoUsoCoreWorker.exe. We had to do some firewall and app whitelisting at first because according to him, he wanted to find out the malware file and do a reverse engineering attack to the hackers server and take down all his/her botnets. None of this could solve the problem because the signs of a hacked PC was still there. So he had to re-install his OS only to later discover that we was dealing with a rootkit/firmware malware. So I'm asking does anyone know how to analyse rootkit/firmware processes? We actually want to find out the malware file and explore with it.

[Biggy_Asian]

Reformat your HDD/SSD best way to do it.

[DramaKing]

So my buddy's PC got hacked by a Russian hacker few weeks ago and ever since he's been trying to take out the malware. At first, we both found out that the windows MoUsoCoreWorker.exe was infected and a fake service was created at a different path instead of C:/Windows/System32/MoUsoCoreWorker.exe. We had to do some firewall and app whitelisting at first because according to him, he wanted to find out the malware file and do a reverse engineering attack to the hackers server and take down all his/her botnets. None of this could solve the problem because the signs of a hacked PC was still there. So he had to re-install his OS only to later discover that we was dealing with a rootkit/firmware malware. So I'm asking does anyone know how to analyse rootkit/firmware processes? We actually want to find out the malware file and explore with it.

First of all, did you really identify a command-and-control server in Russia? It doesn't really mean that the hacker is Russian, so don't assume. Second, there is no such thing as a reverse engineering attack.

Now as for the rootkit, what you need to do is open up the computer and locate the EEPROM chip on the motherboard. Carefully desolder the chip from the board. You'll now need to connect it to a firmware debugger (costs a few hundred bucks or so). This will allow you to dump the firmware and sift through unintelligible UEFI code. Or you could just make sure that Secure Boot is enabled, and the latest BIOS/UEFI update is applied (updating will wipe out any rootkit).

---

Having said all that, you'll want to have your buddy download and run the Farbar Recovery Scan Tool and Malwarebytes Anti-Rootkit. Tha Sneak or Bastille can review the generated log files.

[Pr0m3th3us]

First of all, did you really identify a command-and-control server in Russia? It doesn't really mean that the hacker is Russian, so don't assume. Second, there is no such thing as a reverse engineering attack.

Now as for the rootkit, what you need to do is open up the computer and locate the EEPROM chip on the motherboard. Carefully desolder the chip from the board. You'll now need to connect it to a firmware debugger (costs a few hundred bucks or so). This will allow you to dump the firmware and sift through unintelligible UEFI code. Or you could just make sure that Secure Boot is enabled, and the latest BIOS/UEFI update is applied (updating will wipe out any rootkit).

---

Having said all that, you'll want to have your buddy download and run the Farbar Recovery Scan Tool and Malwarebytes Anti-Rootkit. Tha Sneak or Bastille can review the generated log files.

Also check this thread out, the group is here to help, free of charge.

https://hackforums.net/showthread.php?tid=6292276

[ForgeSMTP]

Reformat your HDD/SSD best way to do it.

Doesn't the drive get formatted properly when the option to format the disk get selected during Windows OS installation?

---

First of all, did you really identify a command-and-control server in Russia? It doesn't really mean that the hacker is Russian, so don't assume. Second, there is no such thing as a reverse engineering attack.

Now as for the rootkit, what you need to do is open up the computer and locate the EEPROM chip on the motherboard. Carefully desolder the chip from the board. You'll now need to connect it to a firmware debugger (costs a few hundred bucks or so). This will allow you to dump the firmware and sift through unintelligible UEFI code. Or you could just make sure that Secure Boot is enabled, and the latest BIOS/UEFI update is applied (updating will wipe out any rootkit).

---

Having said all that, you'll want to have your buddy download and run the Farbar Recovery Scan Tool and Malwarebytes Anti-Rootkit. Tha Sneak or Bastille can review the generated log files.

Well according to him, the hacker is Russian. It all started in a TG group where he dare a Russian hacker. Soon after he gained access to his PC and started social engineering him. He did couple of manipulative tricks and leaked his info and projects on the TG group.

By reverse engineering attack, our intention is simple find out the stub/malware file, analyze the file and figure out the command-and-control server so we can explore further. This is absolutely possible and does exist but the issue right now is figuring out the rootkit/firmware malware file. Recently, the hacker went as far as writing a text on the UI of the HP startup screen. That was a clear indication of a firmware malware or probably a CVE that got exploited.

Isn't it possible todo this "Now as for the rootkit, what you need to do is open up the computer and locate the EEPROM chip on the motherboard. Carefully desolder the chip from the board." without having to tamper with the hardware? "Secure Boot is enabled, and the latest BIOS/UEFI update is applied" we have done this to mitigate the hackers control. "Farbar Recovery Scan Tool and Malwarebytes Anti-Rootkit" we will get this done but can this give information about the rootkits/firmware processes? Also, how effective can it be with secure boot enable?

---

Also check this thread out, the group is here to help, free of charge.

https://hackforums.net/showthread.php?tid=6292276

Okay thanks waiting to hear from @DramaKing before we proceed. But clearly this is a really complicated malware.

[Biggy_Asian]

Doesn't the drive get formatted properly when the option to format the disk get selected during Windows OS installation?

Yes but its best you just wipe the drive pre-installation anyway.

[ForgeSMTP]

Yes but its best you just wipe the drive pre-installation anyway.

Okay thanks

[DramaKing]

Doesn't the drive get formatted properly when the option to format the disk get selected during Windows OS installation?

Absolutely. Formatting the disk using in Windows Setup is like any other format. The sectors with the malware will be unallocated.

---

Well according to him, the hacker is Russian. It all started in a TG group where he dare a Russian hacker. Soon after he gained access to his PC and started social engineering him. He did couple of manipulative tricks and leaked his info and projects on the TG group.

Finally someone who gives actual evidence.

---

By reverse engineering attack, our intention is simple find out the stub/malware file, analyze the file and figure out the command-and-control server so we can explore further. This is absolutely possible and does exist but the issue right now is figuring out the rootkit/firmware malware file. Recently, the hacker went as far as writing a text on the UI of the HP startup screen. That was a clear indication of a firmware malware or probably a CVE that got exploited.

Malware analysis can identify a command-and-control server. This is not an attack. I would not advise attempting to hack the hacker, especially one located in the dark depths of Russia where international law dares not enter. Best you'll likely be able to do is get the IP address blacklisted if that hasn't happened already. And maybe block all Russian IPs and get a good antivirus. There must be a download or some code that the hacker got your friend to run. However, he may have cleared his tracks.

Modifying the boot splash screen is a clear sign of a BIOS rootkit. Secure Boot should prevent the system from booting if enabled.

---

Isn't it possible todo this "Now as for the rootkit, what you need to do is open up the computer and locate the EEPROM chip on the motherboard. Carefully desolder the chip from the board." without having to tamper with the hardware? "Secure Boot is enabled, and the latest BIOS/UEFI update is applied" we have done this to mitigate the hackers control. "Farbar Recovery Scan Tool and Malwarebytes Anti-Rootkit" we will get this done but can this give information about the rootkits/firmware processes? Also, how effective can it be with secure boot enable?

---

That was not meant to encourage you to do this. BIOS/UEFI analysis should only be done by a computer hardware expert. Resoldering the chip is tricky at best, even if you get it removed and can afford the proper equipment. Reading the firmware is not something that can be done without hardware tampering according to my research.

---

Maybe there is a way to do it in software. Try this Charon tool.

https://github.com/ch3rn0byl/Charon/releases/tag/1.0.1

[ForgeSMTP]

Absolutely. Formatting the disk using in Windows Setup is like any other format. The sectors with the malware will be unallocated.

---

Finally someone who gives actual evidence.

---

Malware analysis can identify a command-and-control server. This is not an attack. I would not advise attempting to hack the hacker, especially one located in the dark depths of Russia where international law dares not enter. Best you'll likely be able to do is get the IP address blacklisted if that hasn't happened already. And maybe block all Russian IPs and get a good antivirus. There must be a download or some code that the hacker got your friend to run. However, he may have cleared his tracks.

Modifying the boot splash screen is a clear sign of a BIOS rootkit. Secure Boot should prevent the system from booting if enabled.

---

That was not meant to encourage you to do this. BIOS/UEFI analysis should only be done by a computer hardware expert. Resoldering the chip is tricky at best, even if you get it removed and can afford the proper equipment.

---

Maybe there is a way to do it in software. Try this Charon tool.

https://github.com/ch3rn0byl/Charon/releases/tag/1.0.1

Alright, thanks alot. We will look further and may revert.

[ttbr0]

im still waiting to see some evidence. all text, no images or videos.

[cosmocheats]

So my buddy's PC got hacked by a Russian hacker few weeks ago and ever since he's been trying to take out the malware. At first, we both found out that the windows MoUsoCoreWorker.exe was infected and a fake service was created at a different path instead of C:/Windows/System32/MoUsoCoreWorker.exe. We had to do some firewall and app whitelisting at first because according to him, he wanted to find out the malware file and do a reverse engineering attack to the hackers server and take down all his/her botnets. None of this could solve the problem because the signs of a hacked PC was still there. So he had to re-install his OS only to later discover that we was dealing with a rootkit/firmware malware. So I'm asking does anyone know how to analyse rootkit/firmware processes? We actually want to find out the malware file and explore with it.

Dealing with a rootkit/firmware malware is tricky. You’ll need to check firmware integrity (UEFI/BIOS) using tools like CHIPSEC or GMER for deep scans. Best bet is to flash BIOS, replace storage drives, and reinstall OS on a clean system.

[ForgeSMTP]

im still waiting to see some evidence. all text, no images or videos.

Evidence of what exactly?

---

Dealing with a rootkit/firmware malware is tricky. You’ll need to check firmware integrity (UEFI/BIOS) using tools like CHIPSEC or GMER for deep scans. Best bet is to flash BIOS, replace storage drives, and reinstall OS on a clean system.

We initially wanted to flash the BIOS, but the previously installed BIOS was outdated with 2 CVE vulnerabilities so we did an update. Does updating the BIOS and not flashing it retain any malware in it?

[DramaKing]

Evidence of what exactly?

---

We initially wanted to flash the BIOS, but the previously installed BIOS was outdated with 2 CVE vulnerabilities so we did an update. Does updating the BIOS and not flashing it retain any malware in it?

There is no difference. You flashed a clean image. Everything should be normal now. Case closed.

[ForgeSMTP]

There is no difference. You flashed a clean image. Everything should be normal now. Case closed.

AhhhHaann thought as much. Thanks DramaKing. Would like to come under your mentorship you seem really good.

[Tyr]

AhhhHaann thought as much. Thanks DramaKing. Would like to come under your mentorship you seem really good.

He's better than I am; can say that. Unfortunately one of the most knowledgeable and dedicated WH members to this forum is secluded (or simply doesn't want to join) the malware removal team here which is supposed to consist of group members whom actually possess the skillset of DramaKing, yet seem to overlook their talent. Such a shame because he's probably one of the most qualified individuals on this forum.

Anyway, for rootkit removal, you're gonna want to check up on that every few often as fragments can still lay dormant in parts of your EFI