yonatanasd232132/talkingebnUEFI bootkit malware that performs privilege escalation via token manipulation, bypasses EDR/AV with indirect syscalls and AMSI patching, and exploits CVE-2025-3052 to disable Secure Boot for persistent bootloader hooking.
|-------------------|
| TALKINGBEN : |
|---|
***A BootKit malware that first performes privilage escalation on victim machine. ***using patching on NtTraceEvent and AMSI (memory buffer scanner) which allowes it to bypass windows defender it loads a payload without it being detected. ***Then we use indirect syscalls to write the payload into memory and execute it while evading EDR's and AV's then we gain priviliage esclation (most likely will be implmented using token manipulation). ***After gaining priviliage escalation we load the signed CVE-2025-3052 application (still missing file ) and use its vulnrability for memory writing to set gSecurity2 to 0 essentily turning off secure Boot allowing us to load in our own written UEFI application (hooker.c + findsBOOTER.c which are in the works) which find the bootloader and sets a hook trampoline in it which will allows us to run our own arbitrary shellcode during booting before all security measures are enabled and also allowing the malware to bypass any system reboots/restarts (btw hooker.c and findsBOOTER.c are fried from codex trying to compile them need to go back and fix code ) this part is inspired by black lotus. ***Unique implmentation comes from CVE-2025-3052 which was only like 5 months ago added to the dbx list meaning that for like 75% percent of computers in the world like school computers public computers and computers of old or impressionable people who are not often to update their windows machine, this malware can forever takeover their OS and motherboard. ***In the far future i am planning to implment a C2 server.
