shark.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-09-11 05:03 VT 10/74

Driver Name: shark.sys
MD5: 2b6625b03e86aa1a58b0f0ea5861a644
SHA1: 259cb8dfd4dd4d5b341f2e7cebffe36cb45fe4b7
SHA256: e77d18dd9ef862c5adc03d61cd7b347e54ce460b6eb4a2769186af7bbbe234fb
Imphash: 6e7d84a473dfcc7e557cdbdbe3d96c4b
Vhash: 09407656151d1515151iz3axz
Authentihash: 3766542aa69ebd54e3c5c055b6c49ee878a334d153848d425d882c4c93d6e0bf
Rich PE header hash: ac724cc8fe13ed667166feb620df399f
SSDEEP: 768:C9pAk0EwUb0zGzp++WKOy+QHmhzyKXj0UPCYxEIFoGg0hE51f+15SrbvoPKE:0AkDRb0SXGQHmhzyKXj0U6ZxGgD6suKE
TLSH: T1959384B3E6B290E6C9B6C2384633663BF972386DC33067D7565647861F627D0AD39B00
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-09-11 05:03
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 10/74
Compilation time: 2021-08-30
PDB path: H:\Labs\Shark\Build\Bins\AMD64\Shark.pdb
Country submitter: China, France, Hong Kong, Germany
Flag: Malicious

Description

Shark.sys is the kernel-mode driver component of the Shark project (https://github.com/9176324/Shark). Once loaded, it locates and neutralizes Windows PatchGuard (Kernel Patch Protection) in real time, disabling the kernel’s integrity checks on Windows 7 and later without requiring a system restart.