← Back to driver explorer
Driver intelligenceVulnerableVerified
Alinubx.sys
Alinubx.sys exposes IOCTL 0x222024 to request kernel-mode process termination through the device path \\.\Alinubx. The handler requires an eight-byte input containing a PID (DWORD) and exit status (DWORD), and passes both to a helper using PsLookupProcessByProcessId, ObOpenObjectByPointer, and ZwTerminateProcess. Access requires the driver to be loaded and its device to be accessible; successful termination of protected processes is not established. Abused by the Cruciferra MaaS loader to target AV/EDR processes.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
Alinubx.sysSample 1 · HVCI unknown
- MD5
10b3049f4a954665512eca5d24728c89- SHA1
172c5ce3afab6d63fe12a7e036f20271b9d09c13- SHA256
611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61- Imphash
57a2f40fccb4fb28f3e0fc12f06cf4b2- Authentihash MD5
207e7aaa3c30c8dffeb20fd8f3b72852- Authentihash SHA1
1cbb8931e81f662af15b71db621d78d7988fe704- Authentihash SHA256
c202e7bb00135434321dad49f6c746b1ea071f6e7400a598438868f660f0e887- Machine
- AMD64
- Version
- 1.32
- Publisher
- CnCrypt Foundation
Research & references
- https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025
- https://github.com/magicsword-io/LOLDrivers/issues/412
- https://x.com/YungBinary/status/2092812095456936172
- https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend
- https://github.com/DeathShotXD/0xCr0ssCrush/blob/main/docs/alinubx-analysis.md
Acknowledgement: eSentire Threat Response Unit (TRU), DeathShotXD @eSentire_TRU, @0xDeathShotXD