Driver intelligenceVulnerableVerified

Chaos-Rootkit.sys

Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.

UUID / abcd2c10-1078-4cf9-b320-04ca38d22f98ADDED / 2023-06-05AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Chaos-Rootkit.sysSample 1 · HVCI TRUE

MD5: 9532893c1d358188d66b0d7b0784bb6b
SHA1: d022f5e3c1bba43871af254a16ab0e378ea66184
SHA256: 0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db
Imphash: 3415f704b3149ea9a3d3a54036b208dd
Authentihash MD5: 7f41d82fd2f02bb6e2d621bc225c34b2
Authentihash SHA1: 3b78b68280429db35d224cb4d32033e6c01b8011
Authentihash SHA256: 60fb851ce3da03c319a423979b47a95dd231085d89b26516f3e25164a1a14dfb
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Chaos-Rootkit.sys binPath=C:\windows\temp\Chaos-Rootkit.sys type=kernel && sc.exe start Chaos-Rootkit.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

https://github.com/ZeroMemoryEx/Chaos-Rootkit