LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

wamsdk.sys

Vulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode

UUID / 9cb4b2fa-67fb-4415-a064-7da7bc47e105ADDED / 2025-08-28AUTHOR / The Haag

Known samples 2

0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.

wamsdk.sysSample 1 · HVCI unknown
MD5
b6b51508ad6f462c45fe102c85d246c8
SHA1
96f0dbf52aed0afd43e44500116b04b674f7358e
SHA256
5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c
Imphash
e504668ae8fd87fe157662fab1e99cb1
Authentihash MD5
6c8a730f2594eb45982dfa4a659efa4e
Authentihash SHA1
f3a83a9ef523438b63ddfb2ac322e40a7726d64e
Authentihash SHA256
1c271dfdb905e1fbbb26a62869eef75882684b99095b55e768d433c684365560
Machine
AMD64
Version
1.1.100
Publisher
WatchDogDevelopment.com, LLC.
Download vulnerable sampleView on VirusTotal
wamsdk.sysSample 2 · HVCI unknown
MD5
68def3004db45cb974e789241472fd59
SHA1
3cfad07bdf8006047a78b8234cc6c3c2f35b24ed
SHA256
0be8483c2ea42f1ce4c90e84ac474a4e7017bc6d682e06f96dc1e31922a07b10
Imphash
e504668ae8fd87fe157662fab1e99cb1
Authentihash MD5
6c8a730f2594eb45982dfa4a659efa4e
Authentihash SHA1
f3a83a9ef523438b63ddfb2ac322e40a7726d64e
Authentihash SHA256
1c271dfdb905e1fbbb26a62869eef75882684b99095b55e768d433c684365560
Machine
AMD64
Version
1.1.100
Publisher
WatchDogDevelopment.com, LLC.
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create wamsdk binPath=C:\windows\temp\wamsdk.sys type=kernel && sc.exe start wamsdk

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references