← Back to driver explorer
Driver intelligenceMaliciousVerified
d39DuiY9sxtDSiu4LSvS.sys
This purpose-built kernel loader creates the \\.\wifis device and accepts encrypted PE images through IOCTL 0x222000. Its worker thread decrypts input with an RC4-like routine using the embedded key dsmjklsafbv, manually maps the supplied PE image, resolves imports and relocations, and transfers execution to the unsigned payload in kernel memory.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
d39DuiY9sxtDSiu4LSvS.sysSample 1 · HVCI unknown
- MD5
8e82dfac112073fce1697dbca586b5b9- SHA1
5fdc38f30fefcdad652a761927fa5d4fa9ff1122- SHA256
00833dd6f61e768ec3cfdf2bdc5ef074df07f2df8921558e4c5e5a32e97b4080- Imphash
5445ae5cd933e77e5ece380db932320e- Authentihash MD5
8e692d8ebcedf22274fe23c053c642d3- Authentihash SHA1
98af0d0f259c2d35dedc2f87aded8ba3e6b66a7a- Authentihash SHA256
9360e91c4183f3215254698bf804ed242957451f06a31b0a2b1c8a7f05035f80- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create wifis binPath= C:\windows\temp\d39DuiY9sxtDSiu4LSvS.sys type= kernel && sc.exe start wifisReflectively load and execute an unsigned kernel payload after the loader is installed. · Privileges: Administrator · OS: Windows 10, Windows 11
Research & references
Acknowledgement: wwwab @wwwab123