← Back to driver explorer
Driver intelligenceMaliciousVerified
blacklotus_driver.sys
The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality. Once the persistence is configured, the BlackLotus bootkit is executed on every system start. The bootkits goal is to deploy a kernel driver and a final user-mode component.
Known samples 7
7 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
0x3440_blacklotus_v2_driver.sysSample 1 · HVCI TRUE
- MD5
4ad8fd9e83d7200bd7f8d0d4a9abfb11- SHA1
17fa047c1f979b180644906fe9265f21af5b0509- SHA256
749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c- Authentihash MD5
f5742f4fb216979627236a799f614c43- Authentihash SHA1
5aba7fa2330d68a679c18cfa2c652ac8b3b4770d- Authentihash SHA256
83ac9bf01c2d2ab0f66782fade462864f42b86e53dc455e1441c2a16d0ec2847- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
0x3040_blacklotus_beta_driver.sysSample 2 · HVCI TRUE
- MD5
a42249a046182aaaf3a7a7db98bfa69d- SHA1
1f3799fed3cf43254fe30dcdfdb8dc02d82e662b- SHA256
f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae- Authentihash MD5
188d812252f224a8ea618f8e9f1fdadb- Authentihash SHA1
ede3868d6bb27bee5c0b9a71fef486e405d59816- Authentihash SHA256
265010deb10af80885726edc450867fa69acbde449b51d13bf891322ff5c1c2d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
0x3040_blacklotus_beta_driver.sysSample 3 · HVCI TRUE
- MD5
a42249a046182aaaf3a7a7db98bfa69d- SHA1
1f3799fed3cf43254fe30dcdfdb8dc02d82e662b- SHA256
f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae- Authentihash MD5
188d812252f224a8ea618f8e9f1fdadb- Authentihash SHA1
ede3868d6bb27bee5c0b9a71fef486e405d59816- Authentihash SHA256
265010deb10af80885726edc450867fa69acbde449b51d13bf891322ff5c1c2d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
blacklotus_beta_driver.sysSample 4 · HVCI TRUE
- SHA1
4B882748FAF2C6C360884C6812DD5BCBCE75EBFF- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
blacklotus_beta_driver_2.sysSample 5 · HVCI TRUE
- SHA1
91F832F46E4C38ECC9335460D46F6F71352CFFED- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
blacklotus_beta_driver_3.sysSample 6 · HVCI TRUE
- SHA1
994DC79255AEB662A672A1814280DE73D405617A- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
blacklotus_beta_driver_4.sysSample 7 · HVCI TRUE
- SHA1
FFF4F28287677CAABC60C8AB36786C370226588D- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create blacklotus_driver.sys binPath=C:\windows\temp\blacklotus_driver.sys type=kernel && sc.exe start blacklotus_driver.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Martin Smolár, ESET