← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_090d409f.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_090d409f.sysSample 1 · HVCI TRUE
- MD5
41046ce853788277da0d7e8c4e0a3123- SHA1
e9bca8f4b8c60688eacc7d18c6ba7777c181bb84- SHA256
090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49- Imphash
53ae9acf513f6b93672a362615da5fbb- Authentihash MD5
7ca020674114f5f8aad94c9cc61dccb4- Authentihash SHA1
f27d87a335c87654ebbbde16d41645be85f0424a- Authentihash SHA256
77cb09dc2fc3c56f3b12ad03a85cedbe3a8e0bb876dadfd76a1fb6c57602817b- Machine
- AMD64
- Version
- 1.0.0.807
- Publisher
- Pinchins Technology Co.,Ltd.
Recorded command
sc.exe create driver_c3d48ddd.sys binPath=C:\windows\temp\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sysElevate privileges · Privileges: kernel · OS: Windows 10