← Back to driver explorer
Driver intelligenceMaliciousVerified
changsha
Malicious rootkit masquerading as legitimate CrowdStrike Falcon Sensor driver (CSAgent.sys). Signed with stolen/expired Chinese certificate from 2015. Detected by 61.6% of AV engines as Rootkit.Win64.Agent and Trojan:Win64/AVTamper. Used to establish kernel-level persistence while evading detection by impersonating trusted security software.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
changsha.sysSample 1 · HVCI unknown
- MD5
808568a7dbff8a982fbffec4a827eb4d- SHA1
21a9ca6028992828c9c360d752cb033603a2fd93- SHA256
06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134- Imphash
7ab33df355e966e61729c7fae3a29564- Authentihash MD5
a23891cdabc468d641005cb4e1dbea71- Authentihash SHA1
4d5fc3b8c73a83fe255680fbd9bd5effb3d897e6- Authentihash SHA256
aa65f8fcbaad575284db8f3f55958145a5548de0d9682bf9ac6e5d8c98efe000- Machine
- AMD64
- Version
- 6.34.14806.0
- Publisher
- CrowdStrike, Inc.
Recorded command
sc.exe create changsha binPath=C:\windows\temp\changsha.sys type=kernel && sc.exe start changshaElevate privileges · Privileges: kernel · OS: Windows 10