← Back to driver explorer
Driver intelligenceMaliciousVerified
CSAgent.sys
AbyssWorker rootkit masquerading as a CrowdStrike Falcon sensor driver (CSAgent.sys). Signed with a revoked certificate from Shenzhen yundian Technology Co., Ltd. This is a fully malicious driver that blinds security products by stripping handles, terminating processes, and removing notification callbacks. Identified in ESET EDR killers research (March 2026) deployed alongside Medusa ransomware via the HEARTCRYPT packer.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
CSAgent.sysSample 1 · HVCI unknown
- MD5
9e82ee5bde6b5d29281a3c280e6d1f2e- SHA1
75f85caea52fe5a124fa77e2934abd3161690add- SHA256
b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505- Imphash
97066db6d02bb0811e5e120968f3d28f- Authentihash MD5
33d19e00fba657d4a4d881b0d3f24bb9- Authentihash SHA1
4aabec112c06c86bcc97429af1d9f5d6966be78b- Authentihash SHA256
3e7c62daf3da6ea70530adc9a65bd97dcdb4afe0b82e7622f6d965bdaa99025b- Machine
- AMD64
- Version
- 6.34.14806.0
- Publisher
- CrowdStrike, Inc.
Recorded command
sc.exe create CSAgent.sys binPath=C:\windows\temp\CSAgent.sys type=kernel && sc.exe start CSAgent.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: ESET Research @ESETresearch