acdriver.sys

Malicious Windows Hardware Compatibility Program 2026-09-19

Driver Name: acdriver.sys
SpcSpOpusInfo: OBSS
MD5: 04a8228b5cc5bb5b1d6f92faeda40367
SHA1: 6ec0a727a7fa81772bc60a70077cbd5d294d8c06
SHA256: e21c518d6f913a7b05f97f843c262f70c9ef911fe45315c9d0ed3f7ee922edc7
Imphash: da38ed3ae64881d1e969323b907f8a13
Vhash: 065066651d151d151iz14xz
Authentihash: d8374a2c33f76acf48ecda8943cfa940541320914c1207c13883ec71d92a5825
Rich PE header hash: b88ae0df25ad9269248ef211ae6caa57
SSDEEP: 12288:WArZyx/r99XT4++88AHUd7x5nOoayyApBMK/RvCfJqlOcyE2j2axtRm91JfVX83I:WAFi/rbTYQUVnFp1zMKVjOLFCaQ9TlOI
TLSH: T1F4D4128A15289197CC0AAD306358FE5AAD32939737928CDF149EA6701D477E2B37CD0F
PDB path: D:\project\protect_drive\momo\x64\Release\acdriver.pdb
Compilation time: 2026-06-29
Country submitter: China

Description

The malicious driver is a kernel loader that loads an unsigned kernel driver received from a user-mode client, and its user-to-kernel communication is unusual. The driver still uses an IOCTL dispatch path, but instead of exchanging data through the usual buffered or direct I/O methods, the user-mode client places the payload at *(PEB + 0x2D0) — the AppCompatFlagsUser field.

Reference: PebGhost rootkit loader