Win32/Gapz: New Bootkit Technique | WeLiveSecurity
Win32/Gapz's new bootkit technique modifies just 4 bytes of the original VBR, has an enhanced dropper and complex kernel mode functionality, and evades ELAM.
Aleksander Matrosov Volume Boot Record Initial Program Loader Microsoft Windows Master Boot Record Volume Boot Initial Program Loader
Source: welivesecurity.com