wfr18bud.sys
- Driver Name
wfr18bud.sys- MD5
3c15196e16ad7ad32d05784710dde4df- SHA1
9cb8c4ae3aaab78e187dc2b4b0e5af7574da874e- SHA256
1b365ca1e8894cc1e80f2b9334a2f3ea5152935df72d439616ec7ba98d7e7997- Imphash
dbe3532c6824bd2fb184cdfa88830666- Vhash
084066551d5516551iz17xz- Authentihash
0042a3148ae7cdaa2a667c1926883f14795af6920eb6b96cc4cf61c656ea8552- Rich PE header hash
9175f59573bbb5a107ce551a7b49af1e- SSDEEP
1536:/TbTcm3lLzcLLyOrIpjGqdnkcSdMPksPLOjjHwBR4Uf:gGppP9PLOjjHCR- TLSH
T119731853E6B664C5E8F9C03461D6B23BBEB1B8588330DBDBC601C5425B62BE0B93E745- Signer
上海晴宇网络科技有限公司- Signing date
2020-11-16 07:47- SpcSpOpusInfo
360- VT detections
18/72- Compilation time
2020-11-16- PDB path
C:\Users\user\Desktop\qudong\vad驱动\MAP\x64\Win7Debug\BufferLoadDriver.pdb- Country submitter
- Canada
- Flag
- Malicious
Description
BufferLoadDriver is a kernel loader. It secretly loads an embedded unsigned driver called SuperHacker10 into kernel memory, then unloads itself.
Unsigned driver (SuperHacker10)
• Self-delete: Removes the loader's .sys file from disk.
• Hidden command channel: It creates no device of its own. Instead, it hooks the IOCTL handler of the NDIS network driver (\Driver\Ndis) and receives commands sent to \Device\Ndis. The hook sits inside ndis.sys's own code, so the pointer looks normal.
• 8 commands (IOCTLs):
o Choose the target process
o Read and write its memory
o Find a loaded module's address
o Allocate executable memory in it and disguise that memory from memory scans
o Load a staged DLL-style image into TslGame.exe (PUBG)
o Hide the overlay window from screenshots
The driver is mostly used with Cheat Engine.