Blacklotus Bootkit

[demon]

BlackLotus is an innovative UEFI Bootkit designed specifically for Windows. It incorporates a built-in Secure Boot bypass and Ring0/Kernel protection to safeguard against any attempts at removal. This software serves the purpose of functioning as an HTTP Loader. Thanks to its robust persistence, there is no necessity for frequent updates of the Agent with new encryption methods. Once deployed, traditional antivirus software will be incapable of scanning and eliminating it. The software comprises two primary components: the Agent, which is installed on the targeted device, and the Web Interface, utilized by administrators to manage the bots. In this context, a bot refers to a device equipped with the installed Agent.

FYI: This version of BlackLotus (v2) has removed baton drop, and replaced the original version SHIM loaders with bootlicker. UEFI loading, infection and post-exploitation persistence are all the same.


GENERAL

Written in C and x86asm

Utilizes on Windows API, NTAPI, EFIAPI (NO 3rd party libraries used),

NO CRT (C Runtime Library).

Compiled binary including the user-mode loader is only 80kb in size

Uses secure HTTPS C2 communication by using RSA and AES encryption

Dynamic configuration

Features


HVCI bypass

UAC bypass

Secure boot bypass

BitLocker boot sequence bypass

Windows Defender bypass (patch Windows Defender drivers in memory, and prevent Windows Defender usermode engine from scanning/uploading files)

Dynamic hashed API calls (hell's gate)

x86<=>x64 process injection

Hooking engine API

Anti-Hooking engine (for disabling, bypassing, and controlling EDRs)

Modular plugin system

Setup by modifying the config.c file by including your C2s hostname or IP address. After that compliation should be easy, just keep the included settings in the Visual Studio solution.




Default Panel Credentials:



user: yukari
password:default

Exploit.IN Send

Encrypt and send files with a link that automatically expires to ensure your important documents don’t stay online forever.

send.exploit.in

 

[koeir]

The source is not completed , BookitInitialize function is not defined and there are other parts not completed

 

[Sodinokibi]

BootInitialize is not required at all. UEFI driver is loaded on-the-fly.

 

[Dread Pirate Roberts]

реквестирую обзор.
atavism или кто тут шарит в биосах? Sodinokibi ?

 

[koeir]

BootInitialize is not required at all. UEFI driver is loaded on-the-fly.

There is no function to load the UEFI driver on the fly, plus i didnt find any communication mechanism between the usermode software and the driver, also it seems this have 0 persistence due to the original developer didnt finish the persistence code yet. another thing the download and execute is a joke , he is using UrlDownloadToFIle (and its commented in the code)

 

[Sodinokibi]

There is no function to load the UEFI driver on the fly, plus i didnt find any communication mechanism between the usermode software and the driver, also it seems this have 0 persistence due to the original developer didnt finish the persistence code yet. another thing the download and execute is a joke , he is using UrlDownloadToFIle (and its commented in the code)

The leaked source code isn’t complete and contains mainly the rootkit part and bootkit code to bypass Secure Boot. and you are right not expertwork ) 90% of the code is stolen from Bootlicker and BlackLotus from realoriginal.