← Back to malicious drivers

MagicMouse.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2026-06-09 04:01 VT 1/71

Driver Name: MagicMouse.sys
MD5: 1534f0c0ab20aa01af64a923ff01a123
SHA1: a4ce500aa05e05d5bc05f047751c756ff778da4d
SHA256: 0a3ec61c94cb96e1f8cb0ff9c8f8390fb28da8b95655d4e7df0ec22c7819b9ac
Imphash: c6ee425937417ea20adbc8b6779ac96f
Vhash: 015066556d1516151jz1xz
Authentihash: 033d4af03b396028bbde5e971a1a50eeea336bda577c49c17998cc0a54e25774
Rich PE header hash: 382c954837b8206f43427d58006a4220
SSDEEP: 3072:BcCvrgKU8GI53ZsUbOH/CTkN3HorhDfcCy4KpW:BcCvrPl51SH/CTiolDfcCzZ
TLSH: T120D39E92518903E3C93699F0DBA18EC37CB4B417D350D9EB86D0653628E6DC0BE3E7A5
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2026-06-09 04:01
SpcSpOpusInfo: Langtu Digital
VT detections: 1/71
Compilation time: 2026-06-08
PDB path: MagicMouse.pdb
Country submitter: China, Vietnam, United States
Flag: Malicious

Description

Functionality: A signed kernel Loader driver that loads a hidden second stage, disables Windows driver signature enforcement, and then erases its own traces.

- Hidden payload: The driver imports only one function, MmGetSystemRoutineAddress, and resolves every other API at runtime from XOR-obfuscated strings. Its real payload is a 108 KB PE image stored in .rdata with the normal MZ/PE header removed, so it evades signature and entropy scanning.

- Signature bypass: Once loaded, the payload finds and patches g_CiOptions in CI.dll (Code Integrity), which lets unsigned kernel code load.

- Cleanup: It removes its own entry from the PnP driver-load table and force-deletes its own file from disk.