← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_981d03e1.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_981d03e1.sysSample 1 · HVCI TRUE
- MD5
dbb2e0ecfa1cd1932c32e4f02edff079- SHA1
2c42b38f1cd28f4fc449f7c1a76a4f6aedf38b43- SHA256
981d03e19f14de0ccffef8fa974797d9cdfef6dafc7349d9bbf27434dc16dede- Imphash
ce10082e1aa4c1c2bd953b4a7208e56a- Authentihash MD5
058a346c3da7a6e70387d17a51108223- Authentihash SHA1
f9cfea7546838cf5a9523523eb95d1a434a8898f- Authentihash SHA256
e7ff6a8a70471991d00525b02071eff55a2252d7f8dfb299ac2d169e811f6a84- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10