← Back to driver explorer
Driver intelligenceVulnerableVerified
tm_filter.sys
Teramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
tm_filter.sysSample 1 · HVCI unknown
- MD5
3f9829071109fc051bd7f6b01a35ed46- SHA1
b2c1222c96221e031e9e3b64cf3ae00de5cdcff6- SHA256
e9fda504c9bdbe785c55a279ebb27e31783155570ab0c242e1de5bf79fbca6ed- Imphash
2ccbad8d475d8dbeb3912f266880f807- Authentihash MD5
84ac341afb37740eb5149192da7ff4dc- Authentihash SHA1
abc638c91be3713c31ca41deb4a8e93a4dd18575- Authentihash SHA256
1b3a8c75a3baa3eb37b7c768798cdbbb0cf9390c05f6769691652fd73a239268- Machine
- AMD64
- Version
- 25.38.2933.0 built by: WinDDK
- Publisher
- Teramind Inc.
tmfsdrv2.sysSample 2 · HVCI unknown
- MD5
d8d1c6cd663c9c5a457d8147e10c4e64- SHA1
fc5d815dde49b85efb51e89af45dd011c044f72a- SHA256
2cea1a8d5d23a5ed2c2ac2a0c7c0d95da516aa355224cc707f86de8ade5880ef- Imphash
d65005590d47deb80879f60133ea0147- Authentihash MD5
d559a066d166df693d6033e77edbe6fd- Authentihash SHA1
2328659804f256018d1668e359eec3b4b7250a92- Authentihash SHA256
ba6a35ef49a3cc02aaf727700fe8182d8f6730c48eb69fc8d30e6e4263f8170d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Teramind Inc.
Recorded command
sc.exe create tmfsdrv2 binPath=C:\windows\temp\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2Capture user input and screen content for surveillance · Privileges: kernel · OS: Windows 10