← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_5d61e4ea.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_5d61e4ea.sysSample 1 · HVCI TRUE
- MD5
f3e6580f5f8dacbe2f53ebb9810bc556- SHA1
4d7918c4a051313ac21aba444dac10c61f96ac2e- SHA256
5d61e4ea1b1294d5a042feb152dc5f9aa1397c45c3ed583621279dd4e69be418- Imphash
378f84e7908c5658a205183008105ce5- Authentihash MD5
9c23b046de394f77654d6e364d40d57e- Authentihash SHA1
a6f89366f164febddf1c281df4ccbdbb8d86c91e- Authentihash SHA256
f06493341f9f16b9d25a3a5e07851dd04b63f36904a21ec1da30bfcb9157724c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_ef9d653a.sys binPath=C:\windows\temp\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sysElevate privileges · Privileges: kernel · OS: Windows 10