150156.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-11-14 09:36 VT 39/73

Driver Name: 150156.sys
MD5: b062abcc78ea261befa32921af83f43d
SHA1: e72a03b4711133b0ba557f674a7c7fb0c353aa94
SHA256: 1004d46211f2b7afe6ee5f70abc64757c8c5f9b0f6402530bf536ac113305a04
Imphash: 6778a3c5a5260c24e24c1c872d9e4cfb
Vhash: 054066651d16165559z26z2yz
Authentihash: 01cbb84d1ade1fe1858fd6f2473b52f7db3ffc404d1f02a26577bdbd0259fd69
Rich PE header hash: b8e4f5d40d1b8cc7d0a6524549baf303
SSDEEP: 384:dIEiYiuli4QvVe+IPXcKnASRR6otu+wlprEU8QIAq0ME5wSh/f5TuLh3nX7aJdlF:/ifuli613HM+t/cZh/fEt3X7aJG61
TLSH: T14A338C5254504972C93925308BAEE7573A3C93622F4607CB93E8F4993CF77D0FA6229E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-11-14 09:36
SpcSpOpusInfo: 潜江瑞诚网络信息咨询中心
VT detections: 39/73
Compilation time: 2021-11-14
PDB path: C:\new_plugin\home\shell_driver\Release\rcguard.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader (payload-execution service). Its IRP_MJ_DEVICE_CONTROL handler accepts five independent buffers across five IOCTLs, copying each into kernel memory; a sixth IOCTL then verifies that all five are present and launches them on a kernel system thread via PsCreateSystemThread