Dissecting a Ransomware-Infected MBR - Raul Alvarez - Hack in Paris - 2017
Explore the intricacies of ransomware-infected Master Boot Records (MBR) in this 38-minute conference talk from Hack in Paris 2017. Delve into the boot process, operating system detection, and the critical impact of compromising a single sector on your hard disk. Follow along as Raul Alvarez dissects the malicious code overwriting an MBR, demonstrating how it seizes control of the boot process until ransom payment. Gain insights into debugging the MBR to observe native code execution without APIs. Learn about MBR vs. GPT, execution flow, resolving normal malware, Device IO Control API, Physical Drive Zero, and more. Witness a practical demonstration of MBR debugging and understand the implications of boot sector manipulation in this comprehensive exploration of ransomware techniques.