{"Id":"7d9e8ee4-6725-4216-bc6b-ac3042018d5c","Tags":["SakDriver.sys"],"Author":"Michael Haag","Created":"2026-09-16","MitreID":"T1014","CVE":[""],"Category":"malicious","Verified":"TRUE","Commands":{"Command":"","Description":"SakDriver is a malicious Windows kernel rootkit analyzed by 0xSec. It uses a registry callback for command dispatch and process-memory manipulation, conceals its driver file and service registry entries, and hides network connections through an NSI hook. It also implements WFP destination filtering and HTTP reporting. The sample uses the device name \\Device\\SakDriverWFP and carries a CrackerDrv.pdb path. These findings apply to the analyzed sample; current Windows loadability and HVCI compatibility have not been established.","Usecase":"Kernel rootkit with registry-based command dispatch and concealment","Privileges":"kernel","OperatingSystem":"Windows"},"Resources":["https://0xsec.gitbook.io/0xsec/malware-analysis/sakdriver-reversing-a-kernel-driver-rootkit"],"Acknowledgement":{"Person":"0xSec","Handle":""},"Detection":[{"type":"YARA","value":"https://0xsec.gitbook.io/0xsec/malware-analysis/sakdriver-reversing-a-kernel-driver-rootkit#yara-rule"}],"KnownVulnerableSamples":[{"Filename":"SakDriver.sys","MD5":"b5f122f3f07f618c0a7678fa40801faa","SHA1":"7440358c5041eba34e8673100989df756a6426da","SHA256":"4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d","Signature":["温江区明宇网络技术服务工作室"],"PDBPath":"E:\\tools\\oldfilelaoda\\x64\\Release\\CrackerDrv.pdb","Imphash":"7afd4d4bb61395a3cd7d1b040e1cfd9b","Authentihash":{"MD5":"c151927ea37d72f1f08ccdc94ba37524","SHA1":"a13988ece3adc1f1cb5166cd48abd32050d8540d","SHA256":"47b766019e0e18251ba39e24d20a99f45bdd5c310a4e94091e4f19d9fef27996"},"RichPEHeaderHash":{"MD5":"bcb674caa6a2b25eb0c63348ea36afde","SHA1":"8d4d145fc8b301d8c24015d5afd748a616829cae","SHA256":"d9f5b1c3a8d4bc614ff53bf7a090ccdd7344fe50f118daa1ef56ec50b2d70857"},"Sections":{".text":{"Entropy":6.497323847060668,"Virtual Size":"0x1d202"},".rdata":{"Entropy":5.395923343596321,"Virtual Size":"0x2a10"},".data":{"Entropy":5.3127994185775576,"Virtual Size":"0x82e8"},".pdata":{"Entropy":5.263771568212175,"Virtual Size":"0xe94"},"INIT":{"Entropy":5.2412528304457515,"Virtual Size":"0x137a"},".reloc":{"Entropy":4.779319354051639,"Virtual Size":"0xe4"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-03-19 17:14:01","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["NETIO.SYS","FLTMGR.SYS","fwpkclnt.sys","ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["WskReleaseProviderNPI","WskCaptureProviderNPI","WskQueryProviderCharacteristics","WskDeregister","WskRegister","FltReleaseFileNameInformation","FltGetFileNameInformation","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FwpmEngineClose0","FwpmFilterDeleteById0","FwpmFilterCreateEnumHandle0","FwpmFilterEnum0","FwpmFilterDestroyEnumHandle0","FwpmSubLayerAdd0","FwpmSubLayerDeleteByKey0","FwpmCalloutAdd0","FwpmCalloutDeleteById0","FwpmFilterAdd0","FwpsCalloutRegister3","FwpsCalloutUnregisterById0","FwpmEngineOpen0","FwpmFreeMemory0","RtlAnsiStringToUnicodeString","RtlCompareUnicodeString","RtlEqualUnicodeString","PsLoadedModuleList","strstr","RtlInitUnicodeString","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeQueryTimeIncrement","ExAllocatePool","ExAllocatePoolWithTag","ExFreePoolWithTag","MmMapLockedPagesSpecifyCache","MmMapIoSpace","MmUnmapIoSpace","IoGetDeviceObjectPointer","ObfDereferenceObject","MmCopyMemory","MmIsAddressValid","RtlRandomEx","_vsnwprintf","ZwQuerySystemInformation","ObReferenceObjectByName","strlen","IoDriverObjectType","DbgPrintEx","RtlGetVersion","KeDelayExecutionThread","KeWaitForSingleObject","ExGetPreviousMode","MmBuildMdlForNonPagedPool","PsCreateSystemThread","PsTerminateSystemThread","IoAllocateMdl","IoFreeMdl","ObReferenceObjectByHandle","NtTraceControl","ProbeForRead","ProbeForWrite","IoCreateDevice","IoDeleteDevice","__C_specific_handler","__chkstk","_stricmp","_vsnprintf","RtlIpv4StringToAddressA","ObRegisterCallbacks","ObUnRegisterCallbacks","PsGetProcessId","PsGetThreadProcess","PsProcessType","PsThreadType","PsGetProcessExitStatus","RtlInitAnsiString","KeUnstackDetachProcess","SeLocateProcessImageName","PsReferencePrimaryToken","PsLookupProcessByProcessId","ZwAllocateVirtualMemory","MmGetSystemRoutineAddress","PsGetProcessWow64Process","PsGetProcessImageFileName","PsGetProcessPeb","PsReferenceProcessFilePointer","wcsrchr","_wcsicmp","RtlUnicodeStringToAnsiString","RtlFreeUnicodeString","RtlFreeAnsiString","DbgPrint","CmUnRegisterCallback","CmRegisterCallbackEx","IoGetCurrentProcess","ObReferenceObjectByHandleWithTag","ObCloseHandle","ZwCreateFile","ZwOpenFile","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","ZwCreateKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","ZwSetValueKey","PsGetCurrentProcessId","PsGetCurrentThreadId","IoCreateFileEx","MmFlushImageSection","ZwDeleteFile","IoFileObjectType","ExAllocatePoolWithTagPriority","MmProbeAndLockPages","MmUnlockPages","MmUnmapLockedPages","MmAllocateMappingAddress","MmMapIoSpaceEx","MmAllocateContiguousMemory","MmGetPhysicalMemoryRangesEx","MmGetVirtualForPhysical","IoCreateFileSpecifyDeviceObjectHint","ZwTerminateProcess","ZwFreeVirtualMemory","ZwQueryVirtualMemory","ZwWaitForSingleObject","ZwProtectVirtualMemory","RtlCreateUserThread","PsGetProcessSectionBaseAddress","strcmp","strchr","KeInitializeEvent","KeClearEvent","KeSetEvent","wcslen","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","IoAllocateIrp","IoCancelIrp","IoFreeIrp","ExAcquireFastMutex","ExReleaseFastMutex","ExInitializeNPagedLookasideList","ExDeleteNPagedLookasideList","RtlInitializeGenericTableAvl","RtlInsertElementGenericTableAvl","RtlDeleteElementGenericTableAvl","RtlLookupElementGenericTableAvl","RtlGetElementGenericTableAvl","MmCopyVirtualMemory","KeStackAttachProcess","KeQueryPerformanceCounter"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4","ValidFrom":"2021-09-22 00:00:00","ValidTo":"2031-09-21 23:59:59","Signature":"a739e38a92457e29f6a96c07205c4fee3ddf46a5288696883b92456d7faf9141aa764d6c6141893b73b5274857db9ca4b3138a1303485aee961a7a0e70f162c5e5e6ac03dd3f9e9bac00b37ffa5ac7084eae77d9298714cca9bf542d44d3bff5d3a2895e18bbb206e9c07170cf4c2a5dc65191bcbd4e63171ea88d6862e68bc57c9742966309003fc7cc737abe4bdae176910413cc80acb77c81cdd9474b4cf915d9b0e06f63e4160a93a535384476a3f5f3ca717d5b631415c11eacc4fb2d5904e0fb63005b52ae395a808e39e1db1880136af90ee08f3b969432fbf78058974243fb7e49f28a9e823c389129e5695bae6b6ec4669b2ee27b0164d1b9fb3787","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"1d84ab35223b31c59dadb6ae05646646","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"08e31fda0dd36ccbad797701f69b020c","SHA1":"7ab077d221bce380381e652df959c91e5c8ae8ee","SHA256":"6c93a74ca9feb2eadcbadd8a2a4f2ed3bfa09a13e172f59a4e8cef57abc6fda7","SHA384":"d62b3c6ffa28bd1970aca6d41a572fac4c3bbf2e8cd7ac4ef3fa8e50cf4289d4a9015cc474e2789f5a6cb1263bb757b3"}},{"Subject":"C=AU, O=Verokey, CN=Verokey Secure Code","ValidFrom":"2022-03-17 00:00:00","ValidTo":"2037-03-16 23:59:59","Signature":"74c3d1dc8dd45cfed701518afc951f4ed3b3fecc32043a250af44f0223cdc7796b7e3e6bb74e3d55aa5033e78bf782540828cd279b6810ec366042c88900e37fee4c5ce5ea76bf0c88018976ec5be60070311d4b93cecc53446a3a2115aa33d36e79434113115acf58f162eb5491eb0e958edb4b30e35a73012880e543380a81eb046a7e00fd025d2d4d190ca19e5146d817aa28091f437641d08db61f2b7caeae03ae467ff32d1b32fde22a63f6eb0b0fcf3aa317e38fa9e1f0eb161b57d7ac8dddb4362e7c8852ac9349a464fcfbdc89e88d14fea52faef46d87baea1bcedf5f11d8f50471b0858ad8c54b21f70ce29699724f12fbae3a93eefafd6ab72dd66600bf2cba8548d62876a082f9e490450692238af2c17792a2c647f2c1316fb91600b28829b41669839b45b2c038a56ed7e2d09d0fc297bc1fda9d1f4d61a8bd654bf6855c98390494e4bc6a160b411295097546a4d3a1d286aa85ad93c4717fcb7f9d080010160dfa95d5a53ca0b641f454e63e119939b26bcb1f2fae3d72ec108411334d3f10ca6003e6c00d82d74fa9c38841603604bf22faf95253fbb782372e705fd76adc95c00e350a187f08e3c6eae9bdf0d9a1ae6416c85cc1b4b9f2cda3e562cbdf06532ae7cd5be589091b911cb460d83301e7be134aa067aa1563638f4502a8f13e433b52c8764c43b04a86e2f47f060946cd4e0ad47738a7bb21","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"01b144fb861a74fdc9856aa6b0616b5a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1a8eb4caaffb1997de786e38068977b1","SHA1":"2e6cebf6415431624ba94696467cfd3b7e07816b","SHA256":"ead56e0d0275e1a52d01c5688d025f45d22c1d0ad9e0fa77e4389d44a46d7b3d","SHA384":"faef5f1c5f78eca1a6419fd40ee3f4f4c6be86ac9b8ec88c54a81e36b2e65e4c31eeffb62427d53261041bc94981f4a3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root","ValidFrom":"2005-11-01 13:46:46","ValidTo":"2025-11-01 13:54:03","Signature":"6142e8eb18c871dc4619696dea0ecd3867ac3ea707f64d163c9e57fbb8b8a7c78709e66357d03d469050f50599c9ca743afb01ad7a4d6aab84e0405357c89cd5043682b8b71ec68799c2d8c7209ec6f23e55f98f744451dd2bb6d014ddc6ded2c5ff85af17b9a075dac60de24576961acb3e53fbe9345b3203236cbfd87e9a3d850fc8153b9d00564fafddb1251ca0cc29661b47ce7b67ef64ef484792de9d145069b85f82a9f2ad932b53efab623237eabf040b46eb1984a6aa49a06dc1ab2d83416ab4d6437bd23b7a0cd26dd00d20dc5bc229a7f8822422160135d81ad64422dc476756a6682effc9669ffb7fb464c61e6776e0312e3ad9730d6799c8f5611e5dc1a7b88f311f38dfe3b3874c4db3c4f6605cacac0da02c02b9eff0a35d27bd967d0dd0d44006d1a4d6cb6eb3d536fe48c8f23826563a206aa4c30048e71829e7aba3ab7c07a47fa56b4aba023f86975db96e5924e07c8fedefc3cfaaaf15513fdff728785deb4d1f5d34089b343b2aa1c891097d53c1ff7d801fe06b28d4b9dd587421b89f2dbd153a4e454a5cc3ac7c07b2d02115b8cf69da14e42c24fb66e5019e1a66b4c4ad4d2bad6062e4e48fea370dcad836dc7fdb207a33c04ad61f2de085ce2ba192d754532061867c3703038cfc4347e4f8488bac1a42ea98825d6253816b534630b2e785abbc189c86965986b61aaffafd4831245c011cbb1c","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"729404101f3e0ca347837fca175a8438","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"ee8df66ce2c464c64bb9a9eb9cbd7e90","SHA1":"f4e3b23c5b3673fb06339c35314279fdee1e003f","SHA256":"6d260763a05a13ab7823c6d584f19e5dab26e8e6b56d305ecc7376cd23f411fb","SHA384":"7cb39e0131ea77825f441568bd91846811955cd0f45d547020173347f4fd3d7dfe5bc4952fa4f9675902c4a869328196"}},{"Subject":"C=CN, ST=四川省, L=成都市, O=温江区明宇网络技术服务工作室, CN=温江区明宇网络技术服务工作室","ValidFrom":"2025-10-13 00:00:00","ValidTo":"2029-01-08 23:59:59","Signature":"2577b0487554902f8c1b8e0871e21467f90b62bcec9fea5743d7ff519f5620db939d86fbd78cc0b877f3a2559c78a5442656cba0abdedfbdef49b2a91e56bb2639ba01901087361018c7247667db80712c3cc016302f520ba1639a7140fc4bd8db8853a1872ea609764b7124f49af0ec889e3f2565b10ee38c193a3111c874068367c4383e9063ec5d7faaa0189b2f397fc3ed88afd90d32be3e48b61a5e058d8237aaa987a30687690f9573f90fab2d3e0987c19caac9d1ea2d9c47e4ae7addd326837d95457478d7d1a19274c846921577b561293eb89b4895f3521e494ddea74be9433b0cceeed964accc0e247e2d2545589a5854492953748b7aa239aef0493f9ed5c3984a4dcadd368ab3a55b121e1661171b5ed9da3cde73e6292fd4e2603ae5ff42827b3367631a8f2457b1c5147dde6fbe37164bc4a1a7b7961e617999dd789f41c02d7332074cde8dd90c1d6c616b6d7787a639e5cc34e37abd50bd5210db3ce56e4064c1752f2617953626ef2fd8828765d28ec34610308513cdde40343e2798806b185b7c9eb6d9126dfa3204bee989e1c8d80518aedc9d0d9151e8b40894b443d82137fc0d31cdf072541eb5e2362ea105ea49fa1526e606855b81f601c2abf9f93f6421132f290b439476c9988d6aad110de7c801f52c6c0353164c46169685d6970584124168486f46d87a1ec7735a9ac003ac76e647f86571","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0bcdf5e0da32d68900b8b7638459d072","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a1d616ef3c98ecc4596f8be56e7a941d","SHA1":"9398dd3733891da30c9487b52c9a77bd0c512479","SHA256":"1d96472c1e5297c6979ce6661a9b99fd8b4ec6ceccfa796cc40ded71ddd4ecbf","SHA384":"25eb5f7202bef0368924cecb940b182ebf23b3df6ff2740669bb2ce65df4fa7dd85ee6a33b61b9bd297116e4ea4e9fbd"}}],"Signer":[{"SerialNumber":"0bcdf5e0da32d68900b8b7638459d072","Issuer":"C=AU, O=Verokey, CN=Verokey Secure Code","Version":1}]}]}]}