a42d87de65d7136620b63d5c4ee017ea.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2020-03-27 08:05 VT 38/72

Driver Name: a42d87de65d7136620b63d5c4ee017ea.sys
MD5: a42d87de65d7136620b63d5c4ee017ea
SHA1: b76c3ea60293dae12076ebe5812f53ff85370b78
SHA256: 0856a1da15b2b3e8999bf9fc51bbdedd4051e21fab1302e2ce766180b4931d86
Imphash: 3fb8602cf4f6f47b09a3a3259de6786b
Vhash: 054076651d151666551iz5fxz
Authentihash: d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26
Rich PE header hash: a697b11eb161f3e69b3422b3c479f951
SSDEEP: 1536:w5fUpSOAOCfcp3jtgnseMhIUuoncTlGI:wxUpBAOCfcxSseajJncT
TLSH: T162337D92A3A812D4F592A871C6A5C573DDF0F64A1B3286DF0690CA740F73FE1963D34A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2020-03-27 08:05
SpcSpOpusInfo: Globalsign 中国
VT detections: 38/72
Compilation time: 2020-03-27
PDB path: E:\Pubg\BlackBoneDrv\bin\x64\Win10Release\BlackBoneDrv10.pdb
Country submitter: Singapore, China, Poland, RO, France
Flag: Malicious

Description

BlackBone is a Windows memory-hacking library with an optional kernel driver that provides stealthy DLL injection, manual PE/driver mapping, remote code execution and hooking, and kernel-level memory read/write, process-protection tampering, and memory hiding (https://github.com/darthton/blackbone)