Driver intelligenceMaliciousVerified

daxin_blank.sys

Driver used in the Daxin malware campaign.

UUID / 7e80423f-8b30-4ee2-b904-9f5421826a8cADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

daxin_blank.sysSample 1 · HVCI TRUE

MD5: 62c18d61ed324088f963510bae43b831
SHA1: 8302802b709ad242a81b939b6c90b3230e1a1f1e
SHA256: 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530
Imphash: 4b47f6031c558106eee17655f8f8a32f
Authentihash MD5: 253bde63495fa4f995a6debae44e598e
Authentihash SHA1: 57391d4c4e30f91e3e780d5242fd98a178ec67ac
Authentihash SHA256: a000d211840cb8fbcbf95c334b1d04eadb45ba03b0413c96472e47e9e22413ff
Machine: AMD64
Version: Not recorded
Publisher: Anhua Xinda (Beijing) Technology Co., Ltd.

sc.exe create daxin_blank.sys binPath=C:\windows\temp\daxin_blank.sys     type=kernel && sc.exe start daxin_blank.sys

Elevate privileges · Privileges: kernel · OS: Windows 10