Driver intelligenceVulnerableVerified

360netmon_wfp.sys

Qihoo 360netmon_wfp.sys is a signed kernel driver documented by ESET as the driver abused by the GentleKiller Network Blocker variant used in Gentlemen ransomware intrusions. The sample is associated with ESET detection Win64/VulnDriver.Qihoo360.A.

UUID / acb5da93-1dcc-4d16-8415-6b4b221cb4a1ADDED / 2026-06-22AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

360netmon_wfp.sysSample 1 · HVCI unknown

MD5: 40f64b91348bed955acf8551853b72a8
SHA1: 9ad51ad97c01e97ab59214116740785e0f6320a8
SHA256: 3d769a5f1ad0d32fb4e06478d35401d9788bad1a477b813adbdf4fd93b2c2694
Imphash: 8961b79bdb35a91c4966a20141d1f406
Authentihash MD5: cde694feb0bcdf6edbb714a759b0227d
Authentihash SHA1: b7487b99b29570010545f6538cfe90cccaa34d44
Authentihash SHA256: e4df5e185217887012b88164e0fba76d6869c541f6d64db20da505b9707ef370
Machine: AMD64
Version: 2.4.12.5300
Publisher: 360.cn

Download vulnerable sample ↗View on VirusTotal ↗

Recorded command

sc.exe create 360netmon_wfp binPath=C:\windows\temp\360netmon_wfp.sys type=kernel && sc.exe start 360netmon_wfp

Impair defenses through a signed kernel driver abused by an EDR killer. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: ESET Research, 0xd3vnull @ESETresearch, @0xd3vnull