acdriver.sys

Malicious Windows Hardware Compatibility Program 2026-09-16

Driver Name: acdriver.sys
SpcSpOpusInfo: OBSS
MD5: d5b78ab05759a5032806ad10a47b4afc
SHA1: 9615732ac31333ac4ad85fd69be3028eb13b682d
SHA256: 9c16ce082bc646133a0fd2d2c956671195dc91eac3077ddd2d169dc3f9739a0c
Imphash: da38ed3ae64881d1e969323b907f8a13
Vhash: 024066651d151d151iz14xz
Authentihash: d8374a2c33f76acf48ecda8943cfa940541320914c1207c13883ec71d92a5825
Rich PE header hash: b88ae0df25ad9269248ef211ae6caa57
SSDEEP: 384:UUw9CDRmGl5Zq1E5plND7hw/WT+/ORdth32mTjdAA1m5wMRaMucO6/OE2kWk:Zw9CDRV7Sukq3lTxf1mlRaX76W7C
TLSH: T14BC26CC9236910D7FA5AD474C2B4FD43B83AFA53271285EF44A4E6111FA3BC4A739B18
PDB path: D:\project\protect_drive\momo\x64\Release\acdriver.pdb
Compilation time: 2026-06-29
Country submitter: Hong Kong

Description

The malicious driver is a kernel loader that loads an unsigned kernel driver received from a user-mode client, and its user-to-kernel communication is unusual. The driver still uses an IOCTL dispatch path, but instead of exchanging data through the usual buffered or direct I/O methods, the user-mode client places the payload at *(PEB + 0x2D0) — the AppCompatFlagsUser field.

Reference: PebGhost rootkit loader