acdriver.sys

Malicious Windows Hardware Compatibility Program 2026-07-03

Driver Name: acdriver.sys
SpcSpOpusInfo: OBSS
MD5: 5222b492c25dfd89446329c0249e65cb
SHA1: 3050a6233ec9afa9cad606b6543de2160c108d2a
SHA256: ede9f89342530c6b539d5de4a162c2dbab970b33caaca2c82af35d024a9e3002
Imphash: da38ed3ae64881d1e969323b907f8a13
Vhash: 064066651d151d151iz14xz
Authentihash: d8374a2c33f76acf48ecda8943cfa940541320914c1207c13883ec71d92a5825
Rich PE header hash: b88ae0df25ad9269248ef211ae6caa57
SSDEEP: 768:kw9CDRV7SPkq3O09zb7S1RY1RP1Rc61Rz1Rq1RbC1RG91Rf1Rsqq:l9CDRV7SBeczb7iwflL62YvHq
TLSH: T1F1434AD61A785046ED19AD71C3BCFA53AC39B7C31F9141EF20A6E9200E973E2633C959
PDB path: D:\project\protect_drive\momo\x64\Release\acdriver.pdb
Compilation time: 2026-06-29
Country submitter: China

Description

The malicious driver is a kernel loader that loads an unsigned kernel driver received from a user-mode client, and its user-to-kernel communication is unusual. The driver still uses an IOCTL dispatch path, but instead of exchanging data through the usual buffered or direct I/O methods, the user-mode client places the payload at *(PEB + 0x2D0) — the AppCompatFlagsUser field.

Reference: PebGhost rootkit loader