PoisonX.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2025-03-25 VT 47/71

Driver Name: PoisonX.sys
MD5: 2cc835399634d1f8f50e465201bfd877
SHA1: 4cad3e674682d3d70cc875977f23d71f41ceb55e
SHA256: a5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4
Imphash: 47c3554d0dee53d4f925ed52484bea12
Vhash: 014066551d1516151iz13xz
Authentihash: 1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Rich PE header hash: 088a57b8b352520540d5f0b890dcb421
SSDEEP: 192:0Np/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:0N85rVXcLr7GBJ1ah3yqvDyR9za/io
TLSH: T1FD924BD9493850C6DDABA83182EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2025-03-25
SpcSpOpusInfo: Autel Intelligent Technology Corp., Ltd.
VT detections: 47/71
Compilation time: 2025-03-24
PDB path: D:\Build\PoisonX\Hide\x64\Release\Hide.pdb
Country submitter: PT, Russia, BE, RO, KW, Canada, United States, Malaysia, MX, Germany, Saudi Arabia, Japan, China, SE, Brazil, Indonesia, LV, Luxembourg, Israel, Poland, CO, BG
Flag: Malicious

Description

PoisonX is a malware component that operates as a process protector and concealer. Its main malicious capabilities are:

Killing processes: It provides an IOCTL interface (0x22e010) through which user-mode components can terminate any chosen process by calling ZwTerminateProcess.
Rootkit behavior: It hides processes and threads by hooking other kernel drivers. It uses ObReferenceObjectByName to find the target drivers, then replaces their function pointers so that execution is redirected into its own code.