← Back to driver explorer
Driver intelligenceVulnerableVerified
cyvrlpc.sys
Per Sophos X-Ops research (Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious kernel driver (often with a random five-letter name) signed with compromised or revoked code-signing certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The tool targets many security products by killing their services and processes and is frequently distributed packed with HeartCrypt by ransomware groups (e.g., RansomHub, INC). Driver names are hard-coded per sample (e.g., mraml.sys, noedt.sys).
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
05f8f514d1367aca856564af5443a75f47d22a30ce63f0b024a41e6b9553a527Sample 1 · HVCI unknown
- MD5
43e12d7695fb568b5fce049341ae9175- SHA1
6b76184d186d93cef98df43f1e307eb2ab866c1b- SHA256
05f8f514d1367aca856564af5443a75f47d22a30ce63f0b024a41e6b9553a527- Imphash
ce10082e1aa4c1c2bd953b4a7208e56a- Authentihash MD5
c39d7606489fa399976e2f18373b3e24- Authentihash SHA1
ebf6b77266869267e01671eba82f24497954f1f4- Authentihash SHA256
44c718f75ae2a58e22923644d0caa621d78e8b83fe239d3c1bbba8851274904f- Machine
- AMD64
- Version
- 8.2.2.49708
- Publisher
- Palo Alto Networks, Inc.
Recorded command
sc.exe create cyvrlpc.sys binPath=C:\windows\temp\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Michael Haag m_haggis