YDArkDrv.sys

Malicious Jeromin Cody Eric 2021-03-09 04:08 VT 45/73

Driver Name: YDArkDrv.sys
MD5: 517b56932835f754312c138919ad2240
SHA1: 3f9a3493144a733283f2e707c81a1527d8d462e7
SHA256: c00544768cf3acb3f17506383afa2f30fbe01876ded5612948150a9bfc24387f
Imphash: 5e0af219a433ee57b45bc55b6dbb5935
Vhash: 056096655d757677776519z17z1xz
Authentihash: 8bc36c7ff2f4c93ca9babc1def5f9fd686eae9005fdb12c3c8cbc8a6b6fa8b81
Rich PE header hash: 4299356b77ec207aa0f9305387e41a9c
SSDEEP: 98304:imG9dCLfO0MQsocrL8vAJS5/l+OirHwSfeIjfh+hVxYjEVf2L+H:ip9EW0MQsoML8v68EDrHwFSfheYjEVfl
TLSH: T17546AE5F318B5678E88DC470C6467E7831E6F4213FE4A0EF2DE699D827064E9D17AB02
Signer: Jeromin Cody Eric
Signing date: 2021-03-09 04:08
SpcSpOpusInfo: N/A
VT detections: 45/73
Compilation time: 2021-01-15
PDB path: G:\code\YDArk\1.0.2.1\Release\YDArkDrv.pdb
Country submitter: Australia
Flag: Malicious

Description

YDArk is an open-source x64 Windows kernel tool (https://github.com/ClownQq/YDArk/). It enumerates and restores SSDT/Shadow SSDT hooks, kernel callbacks, driver modules, and network/registry/file artifacts, and can view, dump, or kill processes, threads, and handles. A lightweight PCHunter-style utility for malware analysis and incident response.