6278509.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-11-01 16:00 VT 45/74

Driver Name: 6278509.sys
MD5: 4d4c17d8b52cd89da0b17cc9653b2010
SHA1: 7b83e5e4cf2c647489f09780f4c3cf3c0ea39b05
SHA256: 8ab01313cdca173b2fdca6d56cb2db3be5ccbf0ca22d165870804b26658fa954
Imphash: 89991bcf4c120ef8c83cf0a4feb48842
Vhash: 054076651d1516161519z16z1bxz
Authentihash: c7c3e3c26b4a45b43d03caa6725b379b65819be4b715733b86ff1f37061b8449
Rich PE header hash: 97c5c283acdfa11f619c2a32012e76ba
SSDEEP: 768:5a9MK0tj2g94qgH6TIY6dBxoRzwpY75HZMDADft35G:MMCOP06TIKwqHZYOftpG
TLSH: T14A438F81926018E7D96AAA35C6ABD213F7B4B5161B560BDF01E8D5642FC33C0FF36748
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-11-01 16:00
SpcSpOpusInfo: 潜江瑞诚网络信息咨询中心
VT detections: 45/74
Compilation time: 2021-11-01
PDB path: C:\Users\Administrator\Desktop\新建文件夹\ShellCodeDrv\x64\Release\1\rcguard.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader (payload-execution service). Its IRP_MJ_DEVICE_CONTROL handler accepts five independent buffers across five IOCTLs, copying each into kernel memory; a sixth IOCTL then verifies that all five are present and launches them on a kernel system thread via PsCreateSystemThread