N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-11-14 09:36 VT 42/73

Driver Name: N/A
MD5: ab56fa7fdc28b35b9cf4242fcec41f5d
SHA1: 23b8477d7152dc09e28d3b2f70080b9b6573d91c
SHA256: 98cdfef5969949b7faa32be1cf097cf6a63d9f239021d8038bae3a3b23ebdc81
Imphash: 89991bcf4c120ef8c83cf0a4feb48842
Vhash: 054076651d1516161519z16z1bxz
Authentihash: 9447e7ab921cc04dcd1724b229685d785c615acf195c642cdb8ccc11582d3f47
Rich PE header hash: 97c5c283acdfa11f619c2a32012e76ba
SSDEEP: 768:na9Mg//jdFstMkOjMT30DDlwFsrRHY75HZ1G9t38:qMPakOjMT30JwHZo9tM
TLSH: T196439E85936009E6D52B9930C6AAD353B7B5B0521BA60BDF02E8E5582FC73C0FF25789
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-11-14 09:36
SpcSpOpusInfo: 潜江瑞诚网络信息咨询中心
VT detections: 42/73
Compilation time: 2021-11-14
PDB path: C:\new_plugin\home\shell_driver\x64\Release\rcguard.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader (payload-execution service). Its IRP_MJ_DEVICE_CONTROL handler accepts five independent buffers across five IOCTLs, copying each into kernel memory; a sixth IOCTL then verifies that all five are present and launches them on a kernel system thread via PsCreateSystemThread