← Back to driver explorer
Driver intelligenceVulnerableVerified
CSAgent.sys
Sophos X-Ops (Aug 06, 2025) documents a shared EDR-killer technique where a user-mode loader deploys a malicious kernel driver signed with compromised/revoked certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The driver terminates processes/services of multiple security vendors and is often delivered packed with HeartCrypt during ransomware intrusions (RansomHub, INC, others). Sample-specific driver names (e.g., mraml.sys, noedt.sys) are hard-coded in the payload.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
CSAgent.sysSample 1 · HVCI unknown
- MD5
6d6dfb7a684f7374656aea13ad764e90- SHA1
9ff1a5038a5484b0dba0c6647a1a6c7a5ae2a4d9- SHA256
efb642ad3fab4a2e6cb4de829b60e04dd0d9ae7c2b4cf544de28c38f978b4136- Imphash
4e3c3df003b6a014459f47ae8cb021c7- Authentihash MD5
9df69023b23ef71dbadcdd3e5a7a4782- Authentihash SHA1
3d93083bc4be34358c10ba4f917c260ce5cb357e- Authentihash SHA256
07736986318dbe12f8562e67b874d679baa4f914c2b0a798d4d7f664ade5e3d5- Machine
- AMD64
- Version
- 6.34.14806.0
- Publisher
- CrowdStrike, Inc.
Recorded command
sc.exe create CSAgent.sys binPath=C:\windows\temp\CSAgent.sys type=kernel && sc.exe start CSAgent.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Michael Haag m_haggis