{"Id":"bd5bc879-6602-4338-938e-0873f71bd3d0","Tags":["ampg.sys"],"Author":"Michael Haag","Created":"2026-09-08","MitreID":"T1562.001","Category":"malicious","Verified":"TRUE","Commands":{"Command":"","Description":"Nextron Systems identifies this exact sample as a rootkit combining network interception, obfuscated file operations, and security-product targeting. Observed and embedded filename metadata identify it as ampg.sys. Static analysis confirms WFP filtering and packet-injection paths, XOR-based file transformation, and a process-termination routine explicitly invoked for 360Tray.exe and ZhuDongFangYu.exe. Its embedded version fields claim Microsoft Corporation and SD Crashdump Port Driver; these are file metadata claims, not evidence of Microsoft authorship. No runtime test of successful security-product termination was performed.","Usecase":"Intercept network traffic and attempt to terminate named security processes from kernel mode.","Privileges":"kernel","OperatingSystem":"Windows x64"},"Resources":["https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md"],"Acknowledgement":{"Person":"Nextron Systems Research","Handle":"@nextronresearch"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"ampg.sys","MD5":"7d2e5acea9c550f05fbcc61540ffa1ac","SHA1":"a97182c8b376d1deb07e69e946eb3bc99d6c7670","SHA256":"cacaf0698c6371f8cc45fae85a13fb738f0b8ce0db716c5e4d0d12152de163e3","Imphash":"abcb64dc410e5fb75185251ef1ba338e","Authentihash":{"MD5":"43e9f37b2c2b4c2e57efa3dbb6149607","SHA1":"610a2f9a8cf942f29fd00a4d191261ee884bdd3e","SHA256":"1f3723c9b29af85555813a5fb7ed07f9d83de3096064833dd35afa485413c312"},"RichPEHeaderHash":{"MD5":"87eb5e8553e916d138eb178090d86577","SHA1":"1f2d1964779c0704c37a6413991909345043ffc1","SHA256":"e220fa58f4dd03f7b01e7766c481f158b9890003ec35e49260dc5d4130dfe682"},"Sections":{".text":{"Entropy":6.212933810723102,"Virtual Size":"0x11af9"},".rdata":{"Entropy":5.1627444646514915,"Virtual Size":"0x1ee4"},".data":{"Entropy":2.0096793669435202,"Virtual Size":"0x1780"},".pdata":{"Entropy":5.007306547083402,"Virtual Size":"0xe34"},"INIT":{"Entropy":5.36340501378247,"Virtual Size":"0x1284"},".rsrc":{"Entropy":3.358337998522734,"Virtual Size":"0x3f8"},".reloc":{"Entropy":4.886829494310243,"Virtual Size":"0x144"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-06-25 06:08:44","Description":"SD Crashdump Port Driver","Company":"Microsoft Corporation","InternalName":"ampg.sys","OriginalFilename":"ampg.sys","FileVersion":"10.0.26100.4202 (WinBuild.160101.0800)","Product":"Microsoft® Windows® Operating System","ProductVersion":"10.0.26100.4202","Copyright":"© Microsoft Corporation. All rights reserved.","MachineType":"AMD64","Imports":["fwpkclnt.sys","NDIS.SYS","ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["FwpmEngineOpen0","FwpmEngineClose0","FwpmTransactionBegin0","FwpmTransactionCommit0","FwpmTransactionAbort0","FwpmProviderAdd0","FwpmProviderContextDeleteByKey0","FwpmSubLayerAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerCreateEnumHandle0","FwpmSubLayerEnum0","FwpmSubLayerDestroyEnumHandle0","FwpmCalloutAdd0","FwpmFilterAdd0","FwpsInjectionHandleCreate0","FwpsInjectionHandleDestroy0","FwpmFreeMemory0","FwpsFreeNetBufferList0","FwpsFreeCloneNetBufferList0","FwpsInjectNetworkSendAsync0","FwpsConstructIpHeaderForTransportPacket0","FwpsInjectTransportSendAsync0","FwpsInjectTransportReceiveAsync0","FwpsInjectNetworkReceiveAsync0","FwpsStreamInjectAsync0","FwpsCopyStreamDataToBuffer0","FwpmBfeStateGet0","FwpmBfeStateSubscribeChanges0","FwpmBfeStateUnsubscribeChanges0","FwpsFlowRemoveContext0","FwpsCompleteClassify0","FwpsCloneStreamData0","FwpsDiscardClonedStreamData0","FwpsQueryPacketInjectionState0","FwpsApplyModifiedLayerData0","FwpsAcquireWritableLayerDataPointer0","FwpsReleaseClassifyHandle0","FwpsAcquireClassifyHandle0","FwpsFlowAssociateContext0","FwpsCalloutUnregisterByKey0","FwpsCalloutRegister1","FwpsAllocateNetBufferAndNetBufferList0","FwpsPendClassify0","NdisAllocateNetBufferListPool","NdisWaitEvent","NdisInitializeEvent","NdisFreeGenericObject","NdisAllocateGenericObject","NdisGetDataBuffer","NdisAdvanceNetBufferDataStart","NdisRetreatNetBufferDataStart","NdisFreeNetBufferListPool","KeAcquireInStackQueuedSpinLock","KeReleaseInStackQueuedSpinLock","ExAllocatePoolWithTag","ExUuidCreate","swprintf_s","RtlInitAnsiString","RtlInitUnicodeString","RtlAnsiStringToUnicodeString","RtlAppendUnicodeToString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","ExFreePoolWithTag","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExInitializeNPagedLookasideList","ExDeleteNPagedLookasideList","MmBuildMdlForNonPagedPool","MmGetSystemRoutineAddress","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","MmAllocatePagesForMdl","MmFreePagesFromMdl","PsCreateSystemThread","PsTerminateSystemThread","IoAllocateMdl","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoReleaseCancelSpinLock","ObReferenceObjectByHandle","ObfDereferenceObject","ZwCreateFile","ZwClose","ZwCreateKey","ZwOpenKey","ZwQueryValueKey","ZwSetValueKey","PsGetCurrentProcessId","ZwSetInformationThread","RtlLengthSid","RtlCreateAcl","RtlAddAccessAllowedAce","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwSetSecurityObject","_snwprintf","__C_specific_handler","SeExports","RtlCreateUnicodeString","RtlEqualUnicodeString","KeDelayExecutionThread","ExCreateCallback","ExRegisterCallback","IoGetCurrentProcess","ZwOpenFile","ZwQueryInformationFile","ZwReadFile","ZwWriteFile","RtlPrefixUnicodeString","MmIsAddressValid","PsSetCreateProcessNotifyRoutineEx","PsGetProcessId","IoVolumeDeviceToDosName","IoCreateFileSpecifyDeviceObjectHint","ZwTerminateProcess","ZwOpenProcess","KeStackAttachProcess","KeUnstackDetachProcess","ObQueryNameString","ZwDeleteFile","PsReferenceProcessFilePointer","ZwQuerySystemInformation","_local_unwind","RtlCompareMemory","RtlValidSid","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}