N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-11-01 16:03 VT 38/72

Driver Name: N/A
MD5: f12285df5fc71f5eb6e7be0d88f0e21a
SHA1: 836e9c022ef7f2425c92cb681f315c5eb75316e6
SHA256: 42513650b83aad774ec08185b8b6dc7c39825c4ac0e46ee8ae3516421ad6830f
Imphash: 6778a3c5a5260c24e24c1c872d9e4cfb
Vhash: 054066651d16165559z26z2yz
Authentihash: 61fcce6515109be48d7bcbb5bad5a48fe4c784d51b5c9d3c4e4e3c05a4531425
Rich PE header hash: b8e4f5d40d1b8cc7d0a6524549baf303
SSDEEP: 384:HISYiuli+QjV8kUPccQnAS6REgtI+oMmdprEU8QIAq0ME5wSh/f3+uLh3Bzl73:lfuli71QFK+oMmc/cZh/f3tt3B5
TLSH: T172337D4254504932C57A2530CBADE7473A3CA3612F810B9B97E8F4493DF73D0EA7229E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-11-01 16:03
SpcSpOpusInfo: 潜江瑞诚网络信息咨询中心
VT detections: 38/72
Compilation time: 2021-11-01
PDB path: C:\Users\Administrator\Desktop\新建文件夹\ShellCodeDrv\Release\rcguard.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader (payload-execution service). Its IRP_MJ_DEVICE_CONTROL handler accepts five independent buffers across five IOCTLs, copying each into kernel memory; a sixth IOCTL then verifies that all five are present and launches them on a kernel system thread via PsCreateSystemThread