Driver233.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2020-03-26 13:37 VT 39/73

Driver Name: Driver233.sys
MD5: e0d8aff276891fa803bbafbde5f000d1
SHA1: d28a1c75c0ee978ba1572f7302bb95705a0c6ca1
SHA256: 1d1f7e26109e6cb28c6b369c937b407d7b0cce3c4800ce9852eda94742b12259
Imphash: 3fb8602cf4f6f47b09a3a3259de6786b
Vhash: 054076651d151666551iz5fxz
Authentihash: 0bb5f2eaacd64398a66d73d4617aa0c1209d483fafcbe99e4e12ca6c024db2ec
Rich PE header hash: a697b11eb161f3e69b3422b3c479f951
SSDEEP: 1536:BSnvBpLu6+1IOCxMSqSGtnsz5h4hDoocTl4W:BSvBpLD+1IOCxMxZszDecocj
TLSH: T183336C92A3A411D0F592A871C6A5C573DDF0BA4A1B3286DF06A1CE740F73FE1563D34A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2020-03-26 13:37
SpcSpOpusInfo: Globalsign 中国
VT detections: 39/73
Compilation time: 2020-03-25
PDB path: E:\Pubg\BlackBoneDrv\bin\x64\Win10Release\BlackBoneDrv10.pdb
Country submitter: United Kingdom, France, China
Flag: Malicious

Description

BlackBone is a Windows memory-hacking library with an optional kernel driver that provides stealthy DLL injection, manual PE/driver mapping, remote code execution and hooking, and kernel-level memory read/write, process-protection tampering, and memory hiding (https://github.com/darthton/blackbone)