← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_82d928c5.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_82d928c5.sysSample 1 · HVCI TRUE
- MD5
cfe59d68df1eaa4f33852a60c81f4fd0- SHA1
33a9b4f127141c7995c870a604420c0e770fd81c- SHA256
82d928c586159342837cb457f45619f49db38bb91631a82e4f1b373fb994cd73- Imphash
cbda50455881775aa63196aa112c08c5- Authentihash MD5
73c92f8b2ff75720a4a0601585a86539- Authentihash SHA1
8048a1c6c328db6ea0d0f5aa09579418db9a83d2- Authentihash SHA256
79d48dd02d288dc1788ab3615e6de3c01e575abd19b27434c0f3f557db43592c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_fdd16a94.sys binPath=C:\windows\temp\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sysElevate privileges · Privileges: kernel · OS: Windows 10