← Back to driver explorer
Driver intelligenceVulnerableVerified
927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11
According to Sophos X-Ops (Aug 06, 2025), a widely shared EDR-killer toolkit drops/loads a malicious kernel driver signed with compromised or revoked certificates to disable endpoint protections. Variants target many vendors, and are commonly HeartCrypt-packed and used by ransomware groups (e.g., RansomHub, INC). The payload uses hard-coded driver names (e.g., mraml.sys, noedt.sys) and kills security services/processes.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11Sample 1 · HVCI unknown
- MD5
13ab592c51354e97611b4a77859f3ce7- SHA1
8cd5c8ec1638e178d985bb01777bf0e5ffd1da06- SHA256
927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11- Imphash
83686b18f6322e23404dd4d2b1957b1c- Authentihash MD5
0f8266bec93e8010eb14b1dd865acaf3- Authentihash SHA1
56f83dfd635901406cb1e265be0e30b634f9d32c- Authentihash SHA256
64aee13f5b8a8becd8425b4248d55fccf7047de27291a22a5632a625b62af0ea- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 binPath=C:\windows\temp\927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 type=kernel && sc.exe start 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Michael Haag m_haggis