Driver intelligenceVulnerableVerified

amsdk.sys

Vulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode

UUID / 981210cb-8b84-4d37-b46e-b71059b8c438ADDED / 2025-08-28AUTHOR / The Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

amsdk.sysSample 1 · HVCI unknown

MD5: 47960eb7affa4987ebed6193b0a636b9
SHA1: 5001b8cd2cfb80c8ef43ecb89e45fe687d891e78
SHA256: 12b3d8bc5cc1ea6e2acd741d8a80f56cf2a0a7ebfa0998e3f0743fcf83fabb9e
Imphash: eed27f23ed1b96d3456a64d7611c40ba
Authentihash MD5: cc54e3bc196b4399aa9ed15810a9b3ff
Authentihash SHA1: aecf36814312d5e03dcde35d57367d1994ebbd8f
Authentihash SHA256: cf1bb76946253f9a5b709b5237becfee05d7f56670767aed896763a2641bc854
Machine: AMD64
Version: 1.0.600
Publisher: WatchDogDevelopment.com, LLC.

sc.exe create amsdk binPath=C:\windows\temp\amsdk.sys type=kernel && sc.exe start amsdk

Elevate privileges · Privileges: kernel · OS: Windows 10