Driver intelligenceMaliciousVerified

wantd_5.sys

Driver used in the Daxin malware campaign.

UUID / 3277cecc-f4b4-4a00-be01-9da83e013bcdADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

wantd_5.sysSample 1 · HVCI TRUE

MD5: 6d131a7462e568213b44ef69156f10a5
SHA1: 25bf4e30a94df9b8f8ab900d1a43fd056d285c9d
SHA256: b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3
Imphash: c32d9a9af7f702814e1368c689877f3a
Authentihash MD5: 7c35b7a9bf59a63b84f252906732edde
Authentihash SHA1: ea0d2851b890d39d85bfb0dd1404c87f73aed47f
Authentihash SHA256: 448a507774886c1745beaa86cd0867d93f142f5d2b58d452c5a8250d93359779
Machine: AMD64
Version: 6.1.7600.1172
Publisher: Anhua Xinda (Beijing) Technology Co., Ltd.

sc.exe create wantd_5.sys binPath=C:\windows\temp\wantd_5.sys type=kernel && sc.exe start wantd_5.sys

Elevate privileges · Privileges: kernel · OS: Windows 10