qu829.sys
Kernel driver signed by "Fuqing Yuntan Network Tech Co.,Ltd." (a revoked VeriSign code-signing certificate that Microsoft has flagged as abused). Multiple samples in this family produce a Cobalt Strike beacon reflective loader YARA hit (Elastic protections-artifacts ruleset Windows_Trojan_CobaltStrike) and are detected by Microsoft as Trojan:Win32/Hitbrovi.G. Samples are dropped to C:\Windows under random eight-character filenames (e.g. qu829.exe) and registered as kernel services. Both observed variants share imphash ca73883db8881686fb258a9d289e3909.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
qu829.exeSample 1 · HVCI FALSE
- MD5
9c31fe097a5cac88d27fbe93fda4e056- SHA1
131b5c8a1083393229999f899826fdc459c8ff2b- SHA256
46f2c93c279763a818dffbf89c8893ac0718bd3f5d8fbf327887063068a412a5- Imphash
ca73883db8881686fb258a9d289e3909- Authentihash MD5
88780d79dd6cae782f36fc52ac17bbd8- Authentihash SHA1
5ac2f87cdf1cd081d3bb93e6f11a092be40209c6- Authentihash SHA256
c057c41b368712a5909c51df83ef28a8cf602056996d3763410375e6122edcb2- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
qu829.sysSample 2 · HVCI FALSE
- MD5
08883a5dfc47d41a60f6cea6ec3b445c- SHA1
e09d059f3f563710b0a34e350a57eec11f47bff5- SHA256
57d7a0e5d53a7403c2ea7ae6f6836f43a9fdebefcc8408d66e7dea02ffc41f94- Imphash
ca73883db8881686fb258a9d289e3909- Authentihash MD5
320fe6f6d734b4b45ec373af4791f1c8- Authentihash SHA1
f1fc8b7e6da16e4c99b4dd0acf3d0f8bffe018d2- Authentihash SHA256
93ff1003c1d8aa8e47802fd48942aec4cce58658c80b46488047a4826d568761- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create qu829 binPath=C:\windows\qu829.sys type=kernel && sc.exe start qu829Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Florian Roth @cyb3rops