Driver intelligenceMaliciousVerified

daxin_blank1.sys

Driver used in the Daxin malware campaign.

UUID / 1bf3b155-752a-4cc7-beb0-f202e525eb1aADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

daxin_blank1.sysSample 1 · HVCI TRUE

MD5: a6e9d6505f6d2326a8a9214667c61c67
SHA1: cb3f30809b05cf02bc29d4a7796fb0650271e542
SHA256: 5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae
Imphash: c9a6e83d931286d1604d1add8403e1e5
Authentihash MD5: 7c9b3308f3eb98dd7ddb59b2f6b14656
Authentihash SHA1: 6a9693e262ea82a33b6caee0426512f944366577
Authentihash SHA256: 389d04a947be32b43eab5767f548fc193e9ac5fe5225a3b6dc26ddc80c326d7d
Machine: AMD64
Version: Not recorded
Publisher: Fuqing Yuntan Network Tech Co.,Ltd.

sc.exe create daxin_blank1.sys binPath=C:\windows\temp\daxin_blank1.sys     type=kernel && sc.exe start daxin_blank1.sys

Elevate privileges · Privileges: kernel · OS: Windows 10