LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceMaliciousUnverified

kt2.sys

BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.

UUID / 833fc08f-217d-4d3f-8c8e-782c61120407ADDED / 2023-06-05AUTHOR / Guus Verbeek

The project has not confirmed this driver's sample hashes.

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

kt2.sysSample 1 · HVCI TRUE
SHA1
cb25a5125fb353496b59b910263209f273f3552d
Machine
Not recorded
Version
Not recorded
Publisher
Not recorded

Recorded command

sc.exe create kt2.sys binPath=C:\windows\temp\kt2.sys type=kernel && sc.exe start kt2.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references