{
	"id": "57e437a3-4341-4678-be35-8ffda20cdf67",
	"created_at": "2026-04-06T00:11:59.983569Z",
	"updated_at": "2026-04-10T13:12:20.47729Z",
	"deleted_at": null,
	"sha1_hash": "bf69d3df0d81361042af151bf530335be8de19d5",
	"title": "Extracting ZeroAccess from NTFS Extended Attributes",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 855720,
	"plain_text": "Extracting ZeroAccess from NTFS Extended Attributes\r\nBy Posted by Corey Harrell\r\nArchived: 2026-04-05 16:38:08 UTC\r\nThis past week I was reading a paper about the ZeroAccess Trojan when a section about a clever data hiding\r\ntechnique caught my eye. The paper was Sophos’s The ZeroAccess Botnet: Mining and Fraud for Massive\r\nFinancial Gain and I’m referring to the Services.exe section which stated (on page 6):\r\n\"If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A\r\nsubroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper.\r\nA large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes\r\nare a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be\r\nstored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the\r\nPE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes\r\nit. The shellcode then loads and executes the embedded PE file. This file is a DLL that has equivalent functionality\r\nto the main component, so the services.exe modifications provide a backup means for the bot to function if the two\r\nmain components are discovered and removed.\"\r\nI was already fascinated about the Trojan’s use of two separate DLLs to maintain persistence but what I read\r\nopened my eyes. ZeroAccess leveraged a third DLL for persistence that was hidden inside the NTFS Extended\r\nAttributes. A Google search lead me to a third article by Symantec - Trojan.Zeroaccess.C Hidden in NTFS EA. I\r\nthen remembered a few months back someone from the Yahoo Win4n6 group posted the write-up ZeroAccess –\r\nFrom Rootkit to Nasty Infection – which also discussed ZeroAccess hiding data inside NTFS Extended Attribute.\r\nAt the time, I read the HitmanPro article and bookmarked it amongst my malware references but I didn’t give it\r\ntoo much thought. Now my eyes are open and the use of the NTFS Extended Attribute had my full attention. A\r\nfew thoughts were running through my head (yes in this order)\r\n     1. This is a really cool technique\r\n     2. The articles don’t mention how to extract the data from the Extended Attribute. I wonder how you can do it.\r\n     3. Hiding data in the Extended Attribute is brilliant since antivirus software might not check there. Come to\r\nthink about it most digital forensic tools don’t parse the data inside Extended Attributes either.\r\n     4. Wait a second; I never look at the NTFS Extended Attributes during my examinations. I need to come up\r\nwith a way to do it and add it to my examination process. It could be a check underneath my Malware Searches\r\nexamination step.\r\n     5. Alight, this is definitely cool.\r\nIn this post I’m providing answers to all the questions that were racing through my mind. The post is broken up\r\ninto the sections:\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 1 of 12\n\n- What Are NTFS Extended Attributes\r\n     - My Testing Environment\r\n     - Extracting Data from NTFS Extended Attributes\r\n     - Extracting ZeroAccess from NTFS Extended Attributes\r\n     - Locating Other ZeroAccess Files on System\r\nWhat Are NTFS Extended Attributes\r\nThe NTFS filesystem is the default for the Microsoft Windows server operating systems as well as Windows\r\n2000, XP, Vista, and 7. The Master File Table ($MFT) is the component in NTFS containing information about all\r\nthe files and folders on the volume. “Every file and directory has at least one entry in the table, and the entries by\r\nthemselves are very simple.” The entry basically consists of a header and attributes. Two attributes are the $EA\r\nindex and $EA_INFORMATION which are the NTFS Extended Attributes.\r\nThe File System Forensic Analysis book shows the $EA_INFORMATION type identifier as 208 and $EA\r\nidentifier as 224 (credit goes to Harlan for this reference). The book further stated both attributes are “used for\r\nbackward compatibility with OS/2 applications (HPFS).” In addition, the book Windows Internals, Part 2:\r\nCovering Windows Server 2008 R2 and Windows 7 stated “extended attributes are name/value pairs and aren’t\r\nnormally used but are provided for backward compatibility with OS/2 applications”. The references provide a\r\nlittle more clarity about what the author of ZeroAccess is doing. They are using hardly used $MFT attributes\r\nmeant for backward compatibility as a place to hide data. The cool factor with this technique went up a few\r\nnotches.\r\nTesting Environment\r\nBefore diving into the answers to all my questions I wanted to provide information about my testing environment.\r\nKnowing the testing environment makes it easier for others to see exactly what I did and how to replicate my\r\ntesting. For those looking for the “good stuff” skip ahead to the section Extracting Data from NTFS Extended\r\nAttributes.\r\nFinding the ZeroAccess Sample\r\nIn all the articles about ZeroAccess using the NTFS Extended Attributes I noticed one commonality; this\r\ntechnique was used in an updated version of the Trojan. Check out the commonality: HitmanPro posted their write\r\nup on June 25, 2012, Symantec did theirs on August 14, 2012, and Sophos report was released in September 2012.\r\nFurthermore, Sophos stated in their opening sentence “since our last paper on ZeroAccess, The ZeroAccess\r\nRootkit, its authors have made significant changes.” The point was crystal clear, I needed to find a recent\r\nZeroAccess sample in order to find one leveraging the $EA hiding technique.\r\nI searched for samples in the Virus Share malware repository as you will see why shortly. A generic search for\r\n“zeroaccess” wasn’t to helpful since it resulted in 6,056 results. I needed a more focused search so I turned to\r\nSymantec’s detection Trojan.ZeroAccess.C. It reduced my search results to 9 samples.\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 2 of 12\n\nA nice feature about Virus-Share is it provides links to each sample’s VirusTotal’s report. I used the VT report to\r\nfurther narrow down my samples. On VirusTotal’s Additional Information section, I first looked to see when each\r\nsample was first seen.\r\nRemember the commonality with the articles? I only wanted to focus on samples first seen within the past few\r\nmonths. The second check I did on the Additional Information section was to look at the TrID output to determine\r\nwhat samples were executables as opposed to DLLs. Working with an exe makes it a little easier for fast\r\nexecution.\r\nI narrowed my samples down to five based on the above checks. Not every ZeroAccess Trojan will modify the\r\nservices.exe and store binary data in the NTFS Extended Attribute. So I started executing one sample after another\r\nto see if any modified the services.exe MFT record. I didn’t do any dynamic analysis; I pretty much just ran a\r\nsample and then looked at the services.exe MFT record to see if the Extended Attributes were added. On the third\r\nsample I hit pay dirt. The sample MD5 hash b437274492e215c25f96711d04b44050 (SHA256\r\n658817f5f7722506868d9f717ee19b276fcab0d0ecac071d5d92a4178fdeb5b3) leveraged the NTFS Extended\r\nAttributes.\r\nSide note: I mentioned in the Win4n6 group I was looking for ZeroAccess samples that used the NTFS Extended\r\nAttributes. Stefan replied with not only the MD5 hash c6e73a75284507a41da8bef0db342400 but links to the\r\narticle ZeroAccess - new steps in evolution and the ThreatExpert Report. This sample is the next one I’m going to\r\ncheck out.\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 3 of 12\n\nConfiguring my Test System\r\nThe Sophos report indicated the services.exe is only patched if ZeroAccess is installed on a system with Windows\r\nVista or higher. I selected for my test system Windows 7 Ultimate 32 bit which I was running inside VMware. I\r\nused a fresh install and the only configuration change I made was to disable the User Account Control. I wanted to\r\navoid making ZeroAccess elevate its privileges. I also installed the program Capture.bat as a quick way to see\r\nchanges made to the file system.\r\nExtracting Data from NTFS Extended Attributes\r\nI had to answer my first question before I could go forward with any testing. How do I extract the binary data\r\nfrom the NTFS Extended Attributes? I reached out to the Win4n6 group for suggestions and Brian Carrier pointed\r\nme to the promise land. He suggested I used the Sleuthkit; specifically istat to see what attributes a MFT record\r\nhas and icat to dump the data in an attribute. The process needed to extract data stored inside NTFS Extended\r\nAttributes with TSK is as follows:\r\nNote: the TSK tools can be ran against a forensic image or a mounted drive. My examples throughout the post are\r\nagainst a mounted drive (\\\\.\\PHYSICALDRIVE#) but the path to a forensic image could be used instead.\r\n1. Identify the starting sector of the partition where services.exe is located. Typically, the first sector for Vista and\r\n7 is 2048 (XP is 63). The TSK tool to use is mmls and the command is:\r\nmmls \\\\.\\PHYSICALDRIVE#\r\n2. Identify the inode number for the C:\\Windows\\System32\\services.exe file. The TSK tool to use is ifind and the\r\ncommand is:\r\nifind -o 2048 -n \"Windows/System32/services.exe\" \\\\.\\PHYSICALDRIVE#\r\nCommand explanation: the –o switch is to specify the sector offset that was discovered with mmls and the –n\r\nswitch is the file name to get the inode for.\r\n3. Review the attributes associated with the MFT record for C:\\Windows\\System32\\services.exe. The TSK tool to\r\nuse is istat and the command is:\r\nistat -o 2048 \\\\.\\PHYSICALDRIVE3 12345\r\nCommand explanation: the –o switch is the sector offset and the 12345 is the place where the inode number goes.\r\nThe attributes of interest are $EA_INFORMATION (208) and $EA (224).\r\n4. If present, make note of the NTFS Extended Attributes. In istat’s output, next to the attribute name will be a\r\nvalue inside parentheses. i.e. the value in my test appeared as $EA (224-4)\r\n5. Dump the contents from the $EA and $EA_INFORMATION and redirect it to a file. The TSK tool to use is icat\r\nand the commands are:\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 4 of 12\n\nicat -o 2048 \\\\.\\PHYSICALDRIVE# 12345-208-# \u003e EA_INFO.txt\r\nicat -o 2048 \\\\.\\PHYSICALDRIVE# 12345-224-# \u003e EA.txt\r\nCommand explanation: the –o switch is the sector offset and the number at the end is the inode number with the\r\nattribute value added. The 208-# dumps $EA_INFORMATION and 224-# dumps $EA.\r\nThe above process can be used to either read a MFT’s record attributes or dump the data stored in those attributes.\r\nExtracting ZeroAccess from NTFS Extended Attributes\r\nTo completely answer my first question about how to extract the ZeroAccess Trojan from NTFS Extended\r\nAttributes I actually had to do it. This is what I ended up doing:\r\n     - Determined what a clean MFT services record looks like\r\n     - Located an infected MFT services record\r\n     - Extracted ZeroAccess from the MFT services record\r\n     - Created the ZeroAccess binary\r\nWhat Does a Clean MFT Services.exe Record Look like?\r\nIt’s always good to know what normal looks like so it’s easier to see what is abnormal. This was my thinking and\r\nwhy I first looked at a clean MFT services.exe record. Here’s what I did and what it looked like. I highlighted in\r\nblue values of interest.\r\n1. Confirmed the starting sector for the partition.\r\nmmls \\\\.\\PHYSICALDRIVE2\r\nDOS Partition Table\r\nOffset Sector: 0\r\nUnits are in 512-byte sectors\r\nSlot Start End Length Description\r\n00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)\r\n01: ----- 0000000000 0000002047 0000002048 Unallocated\r\n02: 00:00 0000002048 0020969471 0020967424 NTFS (0x07)\r\n03: ----- 0020969472 0020971519 0000002048 Unallocated\r\n2. Identified the inode number for the C:\\Windows\\System32\\services.exe file.\r\nifind -o 2048 -n \"Windows/System32/services.exe\" \\\\.\\PHYSICALDRIVE2\r\n19211\r\n3. Reviewed the attributes associated with the C:\\Windows\\System32\\services.exe MFT record. Notice there are\r\nno $EA or $EA_INFORMATION attributes listed under the Attributes section.\r\nistat -o 2048 \\\\.\\PHYSICALDRIVE2 19211\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 5 of 12\n\nMFT Record Header Values:\r\nRecord: 19211 Sequence: 1\r\n$LogFile Sequence Number: 34894400\r\nAllocated File\r\nLinks: 2\r\n$STANDARD_INFORMATION Attribute Values:\r\nFlags: Archive\r\nOwner ID: 0\r\nSecurity ID: 450 ()\r\nCreated: 2009-07-13 19:11:26 (Eastern Daylight Time)\r\nFile Modified: 2009-07-13 21:14:36 (Eastern Daylight Time)\r\nMFT Modified: 2012-12-06 11:54:31 (Eastern Standard Time)\r\nAccessed: 2009-07-13 19:11:26 (Eastern Daylight Time)\r\n$FILE_NAME Attribute Values:\r\nFlags: Archive\r\nName: services.exe, services.exe\r\nParent MFT Record: 7150 Sequence: 1\r\nAllocated Size: 0 Actual Size: 0\r\nCreated: 2012-12-06 11:54:31 (Eastern Standard Time)\r\nFile Modified: 2012-12-06 11:54:31 (Eastern Standard Time)\r\nMFT Modified: 2012-12-06 11:54:31 (Eastern Standard Time)\r\nAccessed: 2012-12-06 11:54:31 (Eastern Standard Time)\r\nAttributes:\r\nType: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72\r\nType: $FILE_NAME (48-4) Name: N/A Resident size: 90\r\nType: $FILE_NAME (48-2) Name: N/A Resident size: 90\r\nType: $DATA (128-3) Name: N/A Non-Resident size: 259072 init_size: 259072\r\n750372 750373 750374 750375 750376 750377 750378 750379\r\n750380 750381 750382 750383 750384 750385 750386 750387\r\n750388 750389 750390 750391 750392 750393 750394 750395\r\n750396 750397 750398 750399 750400 750401 750402 750403\r\n750404 750405 750406 750407 750408 750409 750410 750411\r\n750412 750413 750414 750415 750416 750417 750418 750419\r\n750420 750421 750422 750423 750424 750425 750426 750427\r\n750428 750429 750430 750431 750432 750433 750434 750435\r\nLocated an Infected MFT Services.exe Record\r\nThe clean C:\\Windows\\System32\\services.exe file only had four attributes listed. The\r\n$STANDARD_INFORMATION (16-0), $FILE_NAME (48-4), $FILE_NAME (48-2), and $DATA (128-3)\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 6 of 12\n\nattributes. Here’s what an infected services.exe MFT record looks like and what I did. I highlighted in blue values\r\nof interest and items related to the infection in red.\r\n1. Confirmed the starting sector for the partition.\r\nmmls \\\\.\\PHYSICALDRIVE2\r\nDOS Partition Table\r\nOffset Sector: 0\r\nUnits are in 512-byte sectors\r\nSlot Start End Length Description\r\n00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)\r\n01: ----- 0000000000 0000002047 0000002048 Unallocated\r\n02: 00:00 0000002048 0020969471 0020967424 NTFS (0x07)\r\n03: ----- 0020969472 0020971519 0000002048 Unallocated\r\n2. Identified the inode number for the C:\\Windows\\System32\\services.exe file.\r\nifind -o 2048 -n \"Windows/System32/services.exe\" \\\\.\\PHYSICALDRIVE2\r\n42756\r\n3. Reviewed the attributes associated with the C:\\Windows\\System32\\services.exe MFT record.\r\nistat -o 2048 \\\\.\\PHYSICALDRIVE2 42756\r\nMFT Record Header Values:\r\nRecord: 42756 Sequence: 1\r\n$LogFile Sequence Number: 98696063\r\nAllocated File\r\nLinks: 1\r\n$STANDARD_INFORMATION Attribute Values:\r\nFlags: Archive\r\nOwner ID: 0\r\nSecurity ID: 483 ()\r\nLast User Journal Update Sequence Number: 17321736\r\nCreated: 2009-07-13 19:11:26 (Eastern Daylight Time)\r\nFile Modified: 2009-07-13 21:14:36 (Eastern Daylight Time)\r\nMFT Modified: 2012-12-06 17:18:05 (Eastern Standard Time)\r\nAccessed: 2009-07-13 19:11:26 (Eastern Daylight Time)\r\n$FILE_NAME Attribute Values:\r\nFlags: Archive\r\nName: services.exe\r\nParent MFT Record: 1802 Sequence: 1\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 7 of 12\n\nAllocated Size: 0 Actual Size: 0\r\nCreated: 2009-07-13 19:11:26 (Eastern Daylight Time)\r\nFile Modified: 2012-12-06 17:18:05 (Eastern Standard Time)\r\nMFT Modified: 2012-12-06 17:18:05 (Eastern Standard Time)\r\nAccessed: 2012-12-06 17:18:05 (Eastern Standard Time)\r\nAttributes:\r\nType: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72\r\nType: $FILE_NAME (48-2) Name: N/A Resident size: 90\r\nType: $DATA (128-5) Name: N/A Non-Resident size: 259072 init_size: 259072\r\n618 619 620 621 622 623 624 625\r\n626 627 628 629 630 631 632 633\r\n634 635 636 637 638 639 640 641\r\n642 643 644 645 646 647 648 649\r\n650 651 652 653 654 655 656 657\r\n658 659 660 661 662 663 664 665\r\n666 667 668 669 670 671 672 673\r\n674 675 676 677 678 679 680 681\r\nType: $EA_INFORMATION (208-3) Name: N/A Resident size: 8\r\nType: $EA (224-4) Name: N/A Non-Resident size: 23404 init_size: 23404\r\n346 347 348 349 350 351\r\nExtract ZeroAccess from MFT Services Record\r\nThe infected MFT services.exe record had a few different changes. The inode number for\r\nC:\\Windows\\System32\\services.exe changed from 19211 to 42756. In addition, the attributes now listed the NTFS\r\nExtended Attributes: $EA_INFORMATION (208-3) and $EA (224-4). The ZeroAccess binary data can now be\r\nextracted using the attribute values shown with istat. Here’s how I extracted the data.\r\n4. Extracted the binary data from the MFT record for C:\\Windows\\System32\\services.exe for both the\r\n$EA_INFORMATION and $EA attributes.\r\nicat -o 2048 \\\\.\\PHYSICALDRIVE2 42756-208-3\u003e icat_services_$EA-INFORMATION.bin\r\nicat -o 2048 \\\\.\\PHYSICALDRIVE2 42756-224-4 \u003e icat_services_$EA_binary.bin\r\nCreate the ZeroAccess Binary\r\nThe Sophos report indicated the ZeroAccess binary data stored in the NTFS Extended Attribute is shellcode and a\r\nDLL. This means I had to separate the two in the dumped data; my focus was only on the DLL. There was very\r\nlittle data stored in the $EA_INFORMATION attribute while the majority of the data – including the DLL – was\r\nin the $EA attribute. To rebuild the DLL I opened the extracted data in a Hex editor and looked for for a PE file’s\r\ncharacteristics. I was looking for the MZ file signature and the MS-DOS message.\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 8 of 12\n\nI located the MZ signature at offset 1684 so I copied out the binary data from offset 1684 to the end of the file.\r\nThe resulting file was SHA256 ee14dcd20b2ee118618e3a28db72cce92ccd9e85dd8410e02479d9d624934b13\r\nwhich was detected as the ZeroAccess Trojan.\r\nLocating Other ZeroAccess Files on System\r\nLocating the infected services.exe file and extracting the binary data from the NTFS Extended Attributes only\r\naddresses one part of the infection. ZeroAccess drops other files on a system and I wanted to find these as well.\r\nHowever, I didn’t want to cheat by looking at my Capture.bat log file. I wanted to verify how a system timeline\r\nworked by using the services.exe as a starting point to find the other malicious files.\r\nTimelines are my go to tool when I’m trying find files associated with an infection. A timeline can reveal other\r\nactivity occurring on a system around a certain time of interest. In this case, I was interested in seeing the activity\r\naround the time when the services.exe file was last modified as shown below. (the timeline was created with\r\nAnalyzeMFT).\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 9 of 12\n\nThe timeline showed the services.exe file was modified on 12/06/12 at 18:05:09. The activity beforehand included\r\nthe creation of files and folders in both the C:\\Windows\\Installer and C:\\Users\\Lab\\AppData\\Local folders. The\r\nfile named n in both locations is the ZeroAcess Trojan.\r\nSummary\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 10 of 12\n\nStoring data inside the NTFS Extended Attributes is a clever way to hide data. Based on the reports I read,\r\nZeroAccess started to use this technique within the last year. So far it appears as if this is not a commonly used\r\ntechnique to hide data among malware. The only reports I could find only talked about ZeroAccess. However, in\r\ntime I would not be surprised to see other malware families trying to use NTFS Extended Attributes. To see why\r\njust think about these two questions: how many tools are checking the NTFS Extended Attributes for every file\r\nand how many DFIR practitioners and IT staff are actually aware that malware can be hidden there? If I was a\r\nbetting man I’d put my money on both answers being “very few”. My eyes are opened to this hiding technique\r\nand I added a check underneath my Malware Searches examination step to account for it. If I ever need to\r\ndetermine if something is leveraging NTFS Extended Attributes then this is the process I will use.\r\n1. Parse the MFT so that NTFS Extended Attributes are shown for every file. One tool to use is AnalyzeMFT with\r\nthe command\r\nanalyzeMFT.py -f $MFT -o parsed_mft.txt\r\nImport analyzeMFT’s output into Excel or Calc (output is comma delimited format). Apply a sort on the $EA\r\nattribute being true to show every file with a NTFS Extended Attribute.\r\n2. Locate the files’ of interest MFT records. AnalyzeMFT’s output contains this information.\r\n3. Identify the partition’s starting sector. One tool to use is TSK’s mmls with the command:\r\nmmls \\\\.\\PHYSICALDRIVE#\r\n4. Review the attributes associated with any files of interest. One tool to use is TSK’s istat with the command\r\nistat -o 2048 \\\\.\\PHYSICALDRIVE3 12345\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 11 of 12\n\n5. Make note of the NTFS Extended Attributes $EA_INFORMATION and $EA. In istat’s output, next to the\r\nattribute name will be a value inside parentheses.\r\n6. Dump the data from the $EA and $EA_INFORMATION for closer inspection. Use TSK’s icat with the\r\ncommands:\r\nicat -o 2048 \\\\.\\PHYSICALDRIVE# 12345-208-# \u003e EA_INFO.txt\r\nicat -o 2048 \\\\.\\PHYSICALDRIVE# 12345-224-# \u003e EA.txt\r\nHappy Hunting\r\nSource: http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nhttp://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html\r\nPage 12 of 12\n\nmmls \\\\.\\PHYSICALDRIVE# 4. Review the attributes associated with any files of interest. One tool to use is TSK’s istat with the command\nistat-o 2048 \\\\.\\PHYSICALDRIVE3 12345 \n   Page 11 of 12",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html"
	],
	"report_names": [
		"extracting-zeroaccess-from-ntfs.html"
	],
	"threat_actors": [
		{
			"id": "d90307b6-14a9-4d0b-9156-89e453d6eb13",
			"created_at": "2022-10-25T16:07:23.773944Z",
			"updated_at": "2026-04-10T02:00:04.746188Z",
			"deleted_at": null,
			"main_name": "Lead",
			"aliases": [
				"Casper",
				"TG-3279"
			],
			"source_name": "ETDA:Lead",
			"tools": [
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"RbDoor",
				"RibDoor",
				"Winnti",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434319,
	"ts_updated_at": 1775826740,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/bf69d3df0d81361042af151bf530335be8de19d5.pdf",
		"text": "https://archive.orkl.eu/bf69d3df0d81361042af151bf530335be8de19d5.txt",
		"img": "https://archive.orkl.eu/bf69d3df0d81361042af151bf530335be8de19d5.jpg"
	}
}