Malware makes a copy of the original master boot record (MBR) and stores it elsewhere on the hard drive. Malware uses Logical Block Addressing (LBA) to find a physical location of the malicious data. The address of the first sector containing this data is hard-coded into the bootstrap code. The kernel mode driver reads and writes raw data from/onto a hard drive. This data is later copied by the malicious Bootstrap code. The approximation of the technique used by the driver can be found in this article.”]
Source: https://securityintelligence.com/analysis-of-finfisher-bootkit/