← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_d1ea9e16.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_d1ea9e16.sysSample 1 · HVCI TRUE
- MD5
e8f4a9208f93d895493a11d39331cddd- SHA1
f154d0b1c0f9d96efa7ff0218f0aa5298d6f8d49- SHA256
d1ea9e16cefbec53a65a290bb42ee9d6e31218b9d4dfca676b66373cece9a54a- Imphash
bf06985f2031c08da05742e19dae38a7- Authentihash MD5
a47b5fb0cc686fb1f90975b8cdf4c0e1- Authentihash SHA1
3fcf9522a88c416b69e21884112f2c1ce2ad6b50- Authentihash SHA256
4143a5bbea0d303c22d6edc6f43463e336eea9144218e02adad72133266130d2- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10