9974b134-7fee-4c7a-9b0d-38b3b2d7e957

CSAgent.sys

Description

ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.

UUID: 9974b134-7fee-4c7a-9b0d-38b3b2d7e957
Created: 2025-03-26
Author: Michael Haag
Acknowledgement: |

Download Block

This download link contains the vulnerable driver!

Commands

sc.exe create CSAgent.sys binPath=C:\windows\temp\CSAgent.sys type=kernel &amp;&amp; sc.exe start CSAgent.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://www.elastic.co/security-labs/abyssworker

Known Vulnerable Samples

Property	Value
Filename
Creation Timestamp	2024-11-09 09:33:54
MD5	988d7cdc386b2731acc86bbc883e5f31
SHA1	9beea553275b92485fd80e06d27477a2d3656a26
SHA256	6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050
Authentihash MD5	33d19e00fba657d4a4d881b0d3f24bb9
Authentihash SHA1	4aabec112c06c86bcc97429af1d9f5d6966be78b
Authentihash SHA256	3e7c62daf3da6ea70530adc9a65bd97dcdb4afe0b82e7622f6d965bdaa99025b
RichPEHeaderHash MD5	2ca09312be60012aa066d643a69d72ff
RichPEHeaderHash SHA1	0e71795703c824fa2e5e0d0b761d50775c3db9de
RichPEHeaderHash SHA256	1cc4772448093afbb41aad527bb4f2b3a771db71d74db8b9d939a41e5187320f
Company	CrowdStrike, Inc.
Description	CrowdStrike Falcon Sensor Driver
Product	CrowdStrike Falcon Sensor
OriginalFilename	CSAgent.sys

Download

Certificates

Expand

Certificate 51681b3c9e665dd0b29e257146d539dc

Field	Value
ToBeSigned (TBS) MD5	a07c1eefc8261abbdacb43989e8298fb
ToBeSigned (TBS) SHA1	5f9edabc6ac03462ca2ca5e44343281832604f4b
ToBeSigned (TBS) SHA256	11096210ac48d10fce587def92b5eb7a735943b0f62f2f0aaddc3f70f3846a65
Subject	C=CN, ST=, L=, O=, CN=
ValidFrom	2015-07-06 00:00:00
ValidTo	2016-07-05 23:59:59
Signature	c83e0671ac90c10f8b2a698b95ab29067df9d1b5035d0336af66ab2b2a13b8263fa8a56d5229913bcf75e05c06a7b011881946d047e1c8ee95a2d2cdd08c4323d9ce9b1a95232edab3fb278d116906459f6b539730af5da44a9674eede58580cbcae54d2ba791b324b7c9059f6727a6ed9c64c770bd364f075c5e57842d94a4d41e02ef75adbeb4209834355dfb6d9187119d4606578a192421fab6011c789057df24dbd2e347bad2e9ff194a93dae033e27253f1642454be86a4aa327489ed1c8dd4dfcb219a9e6331e3dbcdc272cfb918c90ac5d25c2fe4127eaae5bbd1e6fcaed17850c4f942704a28e38ca030518680639cad083571056f21942ca5caf46
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	51681b3c9e665dd0b29e257146d539dc
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

FLTMGR.SYS
ntoskrnl.exe
HAL.dll

Imported Functions

Expand

FltGetVolumeInformation
FltEnumerateFilters
FltEnumerateVolumes
FltEnumerateInstances
FltObjectDereference
FltGetFilterInformation
wcscat_s
wcslen
wcsrchr
_wcsicmp
RtlInitUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
RtlGetVersion
KeInitializeEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeWaitForSingleObject
KeBugCheckEx
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
CmUnRegisterCallback
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPages
MmGetSystemRoutineAddress
MmUnmapLockedPages
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateFile
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetDeviceObjectPointer
strlen
ObCloseHandle
ObfReferenceObject
ObfDereferenceObject
ObfDereferenceObjectWithTag
ObRegisterCallbacks
ObUnRegisterCallbacks
ZwCreateFile
ZwOpenFile
ZwClose
ZwCreateSection
ZwOpenSection
ZwCreateKey
ZwOpenKey
MmIsAddressValid
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessId
IoGetFileObjectGenericMapping
ZwOpenProcess
KeStackAttachProcess
KeUnstackDetachProcess
PsIsThreadTerminating
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PsGetThreadProcess
PsIsSystemThread
IoThreadToProcess
ObOpenObjectByPointer
ObQueryNameString
ZwDuplicateObject
ZwOpenDirectoryObject
_vsnwprintf
ObCreateObject
SeCreateAccessState
ObSetHandleAttributes
ObReferenceObjectByName
ZwQueryDirectoryObject
ZwQueryInformationThread
ZwQueryInformationProcess
KeInitializeApc
KeInsertQueueApc
__C_specific_handler
__chkstk
IoFileObjectType
PsProcessType
PsThreadType
ExDesktopObjectType
PsInitialSystemProcess
IoDeviceObjectType
IoDriverObjectType
strcmp
ObReferenceObjectByHandle
HalReturnToFirmware

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.reloc
.rsrc
.vlizer

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "51681b3c9e665dd0b29e257146d539dc",
      "Signature": "c83e0671ac90c10f8b2a698b95ab29067df9d1b5035d0336af66ab2b2a13b8263fa8a56d5229913bcf75e05c06a7b011881946d047e1c8ee95a2d2cdd08c4323d9ce9b1a95232edab3fb278d116906459f6b539730af5da44a9674eede58580cbcae54d2ba791b324b7c9059f6727a6ed9c64c770bd364f075c5e57842d94a4d41e02ef75adbeb4209834355dfb6d9187119d4606578a192421fab6011c789057df24dbd2e347bad2e9ff194a93dae033e27253f1642454be86a4aa327489ed1c8dd4dfcb219a9e6331e3dbcdc272cfb918c90ac5d25c2fe4127eaae5bbd1e6fcaed17850c4f942704a28e38ca030518680639cad083571056f21942ca5caf46",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=, L=, O=, CN=",
      "TBS": {
        "MD5": "a07c1eefc8261abbdacb43989e8298fb",
        "SHA1": "5f9edabc6ac03462ca2ca5e44343281832604f4b",
        "SHA256": "11096210ac48d10fce587def92b5eb7a735943b0f62f2f0aaddc3f70f3846a65",
        "SHA384": "6586ec87538e64b8cc68cbe8912a62c485e9d74323daacdc57615d9d60c15e056da9b7829c3b4b7c52c82eab0bebd2fc"
      },
      "ValidFrom": "2015-07-06 00:00:00",
      "ValidTo": "2016-07-05 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "51681b3c9e665dd0b29e257146d539dc",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2025-05-14