← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_ef9d653a.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_ef9d653a.sysSample 1 · HVCI TRUE
- MD5
61ecbe0670717bb544ab4e3e0fe67a90- SHA1
a3c7d629e3db0d9716acaf58132757e17efd8166- SHA256
ef9d653aaa2e629b211cd367a32c381eba694ba85682b987497c287d7dbc0082- Imphash
d64782c3afa48a2c32e43633d44dd9a9- Authentihash MD5
cae3f082947dcbca086f0ee3d8b3f0e1- Authentihash SHA1
0753839d0bd63639c4a003a20542362e523438df- Authentihash SHA256
9088392c38d6b8b7cbcc0959d51f0440f211b037408314b51d393b8aa83d44eb- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_ef9d653a.sys binPath=C:\windows\temp\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sysElevate privileges · Privileges: kernel · OS: Windows 10