KernelDrive.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2026-10-02 15:57 VT 1/72

Driver Name: KernelDrive.sys
MD5: c646ea36ec395c81a2d4f1409fd42a78
SHA1: 751f62ecd4cb95053a041200d0f4c9be026305b6
SHA256: 4db999c85f0a7215ded147cf93afef48d5f1a13a7fddd155ee9d934c19f810dd
Imphash: c31b9c708f21abef2d1e5d4db870673b
Vhash: 015066651d1516151iz3axz
Authentihash: c1efa2e3dcfe6b779919c87e2260557becc63d1d16fddd70651a4166a609c5e2
Rich PE header hash: 5502428d1613177e301bfe4a5f03dfca
SSDEEP: 1536:8/Vct91AC6ATd50uTRpPMUD20v5GfcoOfIYgYYw3fIYl51WsfIY4OWEfIYHyWOfI:8ytLXdSuFpPDTvYc6nwwDNu2UlMTWu6
TLSH: T1DA045EC6493C9083EE56AD7093E8FD93BD3C77C3295189B711AAE5801D8B3C2E32916D
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2026-10-02 15:57
SpcSpOpusInfo: N/A
VT detections: 1/72
Compilation time: 2026-10-02
PDB path: C:\Users\Administrator\Desktop\KernelDrive\x64\Release\KernelDrive.pdb
Country submitter: Hong Kong
Flag: Malicious

Description

A kernel rootkit that registers as a file-system minifilter but filters no file I/O — the minifilter framework is used only to obtain a user-mode communication port. Through that port it exposes arbitrary cross-process memory read/write, remote allocation, and three code-injection primitives to a user-mode client.