Driver intelligenceMaliciousVerified

ntbios_2.sys

Driver used in the Daxin malware campaign.

UUID / 33a9c9ae-5ca3-442d-9f0f-2615637c1c57ADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ntbios_2.sysSample 1 · HVCI TRUE

MD5: 50b39072d0ee9af5ef4824eca34be6e3
SHA1: 064de88dbbea67c149e779aac05228e5405985c7
SHA256: c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c
Imphash: a7bd820fa5b895fab06f20739c9f24b8
Authentihash MD5: a8e3b56b72814a842b557bfb6638b484
Authentihash SHA1: 50231e21b8d8b2916d0fd53f3f58c6314473de1f
Authentihash SHA256: 59177fb7a0b11837368af1cc115f0d011ea19551070bd153795204ae1bd12e52
Machine: I386
Version: 5, 0, 2, 1
Publisher: n/a

sc.exe create ntbios_2.sys binPath=C:\windows\temp \n \n \n  tbios_2.sys type=kernel && sc.exe start ntbios_2.sys

Elevate privileges · Privileges: kernel · OS: Windows 10