Driver intelligenceMaliciousVerified

wantd.sys

Driver used in the Daxin malware campaign.

UUID / 892292f9-b87c-40a5-80e5-8c9b02914e8bADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

wantd.sysSample 1 · HVCI TRUE

MD5: b0770094c3c64250167b55e4db850c04
SHA1: 6abbc3003c7aa69ce79cbbcd2e3210b07f21d202
SHA256: 06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4
Imphash: c32d9a9af7f702814e1368c689877f3a
Authentihash MD5: 1ed42c05e43c14ab16d16fbe8eaed870
Authentihash SHA1: 68cb54489a0556594a28f5f1410cc64d74a1c182
Authentihash SHA256: a47b9af109988e8e033886638edc84964968eecd0d24483eafaad6a6d68005ea
Machine: AMD64
Version: 6.1.7600.1172
Publisher: Anhua Xinda (Beijing) Technology Co., Ltd.

sc.exe create wantd.sys binPath=C:\windows\temp\wantd.sys type=kernel && sc.exe start wantd.sys

Elevate privileges · Privileges: kernel · OS: Windows 10