← Back to driver explorer
Driver intelligenceVulnerableVerified
vboxdrv.sys
Used by unknown actor in Acid Rain malware. vboxdrv.sys is a vulnerable driver.
Known samples 7
0 recorded TRUE · 7 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
vboxdrv.sysSample 1 · HVCI FALSE
- MD5
bce7f34912ff59a3926216b206deb09f- SHA1
696d68bdbe1d684029aaad2861c49af56694473a- SHA256
78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f- Imphash
6723b1d5bd0f1fc13216cb44541e619e- Authentihash MD5
368a4f14c62575191a0f1f3464513964- Authentihash SHA1
3ce88266cfc41e8980d4c185235fd55999f5a67a- Authentihash SHA256
a5a2fe8ab935cf47f21e0c5e0de11a98271054109827dc930293b947d3b05079- Machine
- AMD64
- Version
- 2.2.0.r45846
- Publisher
- Sun Microsystems, Inc.
vboxdrv.sysSample 2 · HVCI FALSE
- MD5
eaea9ccb40c82af8f3867cd0f4dd5e9d- SHA1
7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c- SHA256
cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986- Imphash
b262e8d078ede007ebd0aa71b9152863- Authentihash MD5
d146876f270e848875465ed081396d3b- Authentihash SHA1
c54fe31ff5c3cfe1937b7b0906882a1786f453b6- Authentihash SHA256
597e7d5feb149d9087888926d1454dc06f1078ab18c948b44f090910da8645f8- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
vboxdrv.sysSample 3 · HVCI FALSE
- MD5
154fd286c96665946d55a7d49923ad7e- SHA1
2ae1456bb0fa5a016954b03967878fb6db4d81eb- SHA256
b50b11e2203942695380869c6072e15479290bc57da2ec5df3481a36b8a8561e- Imphash
4c5fc4519f1417f0630c3343aab7c9d2- Authentihash MD5
8dee0a554d557c93b06a9f03f028c7f6- Authentihash SHA1
cbe79825ff30fef67ee1f9ba01e7b880759f1f25- Authentihash SHA256
1d1bd2235d422954506b1bdb3070d9d8bada3fb7f9e4f658036031294b3a95df- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
vboxdrv.sysSample 4 · HVCI FALSE
- MD5
ee91da973bebe6442527b3d1abcc3c80- SHA1
b7fa8278ab7bc485727d075e761a72042c4595f7- SHA256
d998ea6d0051e17c1387c9f295b1c79bacb2f61c23809903445f60313d36c7fd- Imphash
c17c0bd619c1e188ffe27bd328dd7d08- Authentihash MD5
a16b80ddf8f535c1ff695f7eaf0cdcc5- Authentihash SHA1
1ed5e0fadb97e30fa8708833f19ccf5e717f48e2- Authentihash SHA256
4ef8c776a6acd4fd360b22e7d053bba961d687c36ec4fcc0b3e2ff1ef7be967e- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
vboxdrv.sysSample 5 · HVCI FALSE
- MD5
3b23808de1403961205352e94b8f2f9b- SHA1
eaddeefe13bca118369faf95eee85b0a2a553221- SHA256
775000c4083c8e4dcfc879d83fcd27b40b46820c9834ae4662861386a4d81fe9- Imphash
b262e8d078ede007ebd0aa71b9152863- Authentihash MD5
4b67c5cc8038b488359fbd1c08779fcf- Authentihash SHA1
a5b298457abe85bfb86b289328ef82823b0cc173- Authentihash SHA256
a2d9f91ede8aed51960ca67318ea337152bb311c03275c0650e4421e6af6b7ee- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
vboxdrv.sysSample 6 · HVCI FALSE
- MD5
9f94028cbcf6789103cb5bb6fcef355d- SHA1
356172a2e12fd3d54e758aaa4ff0759074259144- SHA256
d44848d3e845f8293974e8b621b72a61ec00c8d3cf95fcf41698bbbd4bdf5565- Imphash
b262e8d078ede007ebd0aa71b9152863- Authentihash MD5
d97b34a86af237bc03339236b32e78d1- Authentihash SHA1
3aaf86c2b226b5f8901af51c9bb37b1847430250- Authentihash SHA256
8561c82c5ae1ab2a5d9214adc620875d83ed7cb9a01253988f5e5aceffe7a901- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
vboxdrv.sysSample 7 · HVCI FALSE
- MD5
1c31d4e9ad2d2b5600ae9d0c0969fe59- SHA1
c8ec23066a50800d42913d5e439700c5cd6a2287- SHA256
73fddd441a764e808ed6d6b8f3d0d13713e61221aa3cfef7da91cdaf112fe061- Imphash
a7ff164c1ee5113a0a09e66b2cd03544- Authentihash MD5
da7c063c8f8dab54afddd9b05c602bfd- Authentihash SHA1
24d47cea65e118d12c6896fdf141bb5dcfe31b98- Authentihash SHA256
b5d0849fc567c169176c2002dd358240d75ca0aacfca92c79d252006c6e0444e- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create vboxdrv.sys binPath=C:\windows\temp\vboxdrv.sys type=kernel && sc.exe start vboxdrv.sysElevate privileges · Privileges: kernel · OS: Windows 10