Driver intelligenceMaliciousVerified

mJj0ge.sys

The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate

UUID / 412f4aaf-5525-458c-b87e-311e504b856dADDED / 2023-05-07AUTHOR / Guus Verbeek

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

mJj0ge.sysSample 1 · HVCI TRUE

MD5: 3d0b3e19262099ade884b75ba86ca7e8
SHA1: 0883a9c54e8442a551994989db6fc694f1086d41
SHA256: 5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b
Imphash: 2a008187d4a73284ddcc43f1b727b513
Authentihash MD5: 83f21305be7f7633dd4c48cf1d523ad9
Authentihash SHA1: 707122f1d7cac4419bd5e5d2da1eb947852d38c0
Authentihash SHA256: a720c9a95ab33b29c19fc37fed2b4d2079a2e4b9bd861d406043bd6010fc4d71
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

sc.exe create mJj0ge.sys binPath=C:\windows\temp\mJj0ge.sys type=kernel && sc.exe start mJj0ge.sys

Elevate privileges · Privileges: kernel · OS: Windows 10