Driver876.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2020-04-01 09:54 VT 45/71

Driver Name: Driver876.sys
MD5: f3d441e0aa7b2361058ffed2b524747e
SHA1: f94196987d123ff9937b371826821124df8ab709
SHA256: 8e0b330a8df3076153638f5b76afc24d1083ebccc60e4d63ee0df5c11c45d58a
Imphash: 74cb5272939c3535feb98bcd96a408ed
Vhash: 016086651d15666657651iz62xz
Authentihash: d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3
Rich PE header hash: 84e6254ef34ee6a7ff6781f87f924adf
SSDEEP: 24576:FcsvhpvJa+34cBX9/jtlyzlPZ9qIYeF5Sebl8Femak7ys28VmXiH8RQe7Gb:+YzvQ+34mLyzxvYe7Gwmak7yMAzb7Gb
TLSH: T18435AEAD64803389C41B84348423FD59B2F4561F57C8C6E7B1EB9EC06BAF966E506F0E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2020-04-01 09:54
SpcSpOpusInfo: Globalsign 中国
VT detections: 45/71
Compilation time: 2020-03-25
PDB path: E:\Pubg\BlackBoneDrv\bin\x64\Win10Release\BlackBoneDrv10.pdb
Country submitter: United Kingdom, China
Flag: Malicious

Description

BlackBone is a Windows memory-hacking library with an optional kernel driver that provides stealthy DLL injection, manual PE/driver mapping, remote code execution and hooking, and kernel-level memory read/write, process-protection tampering, and memory hiding (https://github.com/darthton/blackbone)