ab419dbcda2c63d2ee358c24554456ad.virus
- Driver Name
ab419dbcda2c63d2ee358c24554456ad.virus- MD5
ab419dbcda2c63d2ee358c24554456ad- SHA1
7266ba09de3afd80b562558553432fb0271cf2db- SHA256
ce47f4aed1ebf71caf86bd5710e5c5782112a84fb98a7fc20d1f38d0e968b37d- Imphash
dbe3532c6824bd2fb184cdfa88830666- Vhash
084066551d5516551iz17xz- Authentihash
503ae793a4e7f918227022522abc96dd61373d4399250e30893d28a3219a7ccd- Rich PE header hash
9175f59573bbb5a107ce551a7b49af1e- SSDEEP
1536:6TbTcm3lLzcLLyOrIpjGqdDkcTrMPksfLuSwwrGRIUf:hGlEP9fLuSwpR- TLSH
T192730853E6B624C4E8F9C43461D6B23BBEB179988330CBDBC601C5425B62BE0B97E745- Signer
上海晴宇网络科技有限公司- Signing date
2020-11-16 07:47- SpcSpOpusInfo
360- VT detections
16/73- Compilation time
2020-11-16- PDB path
C:\Users\user\Desktop\qudong\vad驱动\MAP\x64\Win7Debug\BufferLoadDriver.pdb- Country submitter
- Canada
- Flag
- Malicious
Description
BufferLoadDriver is a kernel loader. It secretly loads an embedded unsigned driver called SuperHacker10 into kernel memory, then unloads itself.
Unsigned driver (SuperHacker10)
• Self-delete: Removes the loader's .sys file from disk.
• Hidden command channel: It creates no device of its own. Instead, it hooks the IOCTL handler of the NDIS network driver (\Driver\Ndis) and receives commands sent to \Device\Ndis. The hook sits inside ndis.sys's own code, so the pointer looks normal.
• 8 commands (IOCTLs):
o Choose the target process
o Read and write its memory
o Find a loaded module's address
o Allocate executable memory in it and disguise that memory from memory scans
o Load a staged DLL-style image into TslGame.exe (PUBG)
o Hide the overlay window from screenshots
The driver is mostly used with Cheat Engine.