Driver.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2026-10-22 16:39 VT 2/72

Driver Name: Driver.sys
MD5: 63dd02326beba1fc999ec1ca189099c8
SHA1: 51cf0b1f2400f9eb1aebd97450e343430de60300
SHA256: 2dbfc0a4de3e37bb69a92ad7ebe9de3951377110ccaf9cbb491495e08d719e02
Imphash: 73290cd94d1504a43c83742f86e9074b
Vhash: 025066655d1516551iz73xz
Authentihash: e18b989b6e05cda954fc3e521f367fbbcf7fdd412674a91f546fe8828c1cf3a9
Rich PE header hash: f0f93396350bd274b747303e22494b3c
SSDEEP: 3072:73UoqAK1whweWLvaweuFpPDTvYcEiEFEn/ah2PLPCP0I:TrbhwpvpPw
TLSH: T17B346D865638A0C3EE46EDB0C3A8FD53BD7877C729118E6F11A6D4801E8B3D1E72916D
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2026-10-22 16:39
SpcSpOpusInfo: N/A
VT detections: 2/72
Compilation time: 2026-10-22
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

A malicious Windows driver that, once loaded, blocks the loading of specific Windows kernel drivers (identified by file hash, read from a .dat file in the same directory as the driver) by patching their driver entry with XOR eax, eax; ret. It also injects a payload from disk into winlogon.exe, and its IOCTL dispatch function allows it to install a network proxy on the machine.