xhunter1.sys
Wellbia xhunter1.sys is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-3609 through version 2023.12.7.78. Public research demonstrates that its unauthenticated command channel can expose protected-process handles, read cross-process memory, terminate security processes, elevate privileges, and inject code from kernel context. Beazley Security also reported this driver family in an INC ransomware affiliate intrusion; the report does not identify the exact sample hash for this family.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
xhunter1.sysSample 1 · HVCI unknown
- MD5
c61c16de83acabd35ee18e410c1c37c1- SHA1
852049ecfd6a42370f2d6ed0d5e67e52c8d88211- SHA256
e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e- Imphash
49fb0d422e6e128d1184af793f7f8c79- Authentihash MD5
fab640bd776f3d1098bbc4fb366f1515- Authentihash SHA1
5aca2a43c5a9f1fc59bff578e739a8ab8edecc6f- Authentihash SHA256
85a3cacfb0eb01fc5784695ccf6bd92a537637ecad747eb162331e78da68eee4- Machine
- AMD64
- Version
- 10.0.10011.16384
- Publisher
- Wellbia.com Co., Ltd.
xhunter1.sysSample 2 · HVCI unknown
- MD5
01d01adc1241c8f0a4caf6764439679c- SHA1
722a040af40397626f701b7e02ef3a6715c8259a- SHA256
0d1fd685dc98d0c193529df3ddde7144d839f56b7b38251fd7039c33c0fcf760- Imphash
1b6804e310b6be3b3a4fd962cf3e7973- Authentihash MD5
1234fcf09d3fd5643e17eaab620a40dc- Authentihash SHA1
bd42b25e6cb86e49c1ae0f6c563545c53b9c1c24- Authentihash SHA256
12d5000637d3894acd900082f22efd5aa2133b679b1cc145444493e25297f1ee- Machine
- AMD64
- Version
- 2023.12.7.78
- Publisher
- Wellbia.com Co., Ltd.
Recorded command
sc.exe create xhunter1 binPath= C:\windows\temp\xhunter1.sys type= kernel && sc.exe start xhunter1Terminate protected processes by abusing vulnerable xhunter1 kernel command paths. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
- https://labs.beazley.security/articles/an-inc-ransomware-affiliates-byovd-buffet
- https://github.com/BlackSnufkin/BYOVD/tree/main/Xhunter1-Killer
- https://web.archive.org/web/20180820182619/https://x86.re/blog/xigncode3-xhunter1.sys-lpe/
- https://blacksnufkin.github.io/posts/Hunting-the-Hunter/
- https://github.com/BlackSnufkin/AxHunter
- https://www.cve.org/CVERecord?id=CVE-2026-3609
Acknowledgement: BlackSnufkin @BlackSnufkin42