YDArkDrv.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-12-07 10:39 VT 20/73

Driver Name: YDArkDrv.sys
MD5: 98638051c8467ac8e90b466cb334209b
SHA1: 38b81184e20c04d1f99a8dae8018c8d4bf259f50
SHA256: e31e521e93d66600822fd0021b7388f8e437faf9540a40e665d901e2d3a32c8c
Imphash: 5e0af219a433ee57b45bc55b6dbb5935
Vhash: 0960a6655d757677777519z17z1xz
Authentihash: 0aabf1ca4d383a8477d59dff8c92536b75698a6ad993d2630d9de2ca4e8d2463
Rich PE header hash: e91a91edef6e67d380b5bd50a38f0bb0
SSDEEP: 196608:sG6+DO/Gz2XOvHTkgQIa4nmaD5piPIN5AQP6MVGQ9UrMb:NjO/GoOrFtauD5EINJP6BQ9Ug
TLSH: T1FE967CE620CA63DCC41EC63B8213FD2F95DF713A0725A4E76198A6429E65CC0767BF09
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-12-07 10:39
SpcSpOpusInfo: Shenzhen Tencent Computer Systems Company Limited
VT detections: 20/73
Compilation time: 2021-09-14
PDB path: G:\code\YDArk\1.0.2.4\Release\YDArkDrv.pdb
Country submitter: CZ
Flag: Malicious

Description

YDArk is an open-source x64 Windows kernel tool (https://github.com/ClownQq/YDArk/). It enumerates and restores SSDT/Shadow SSDT hooks, kernel callbacks, driver modules, and network/registry/file artifacts, and can view, dump, or kill processes, threads, and handles. A lightweight PCHunter-style utility for malware analysis and incident response.