← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_4f9b5a2f.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_4f9b5a2f.sysSample 1 · HVCI TRUE
- MD5
d6220f35d2ab7e028e21d5420e12ee93- SHA1
e6e2e01c527d52fe6b2d377043a1ed77f7257d73- SHA256
4f9b5a2fe29c436a53d36d8a2084369ac6a8cd59b9eb01b3d3fa293f3487d3cc- Imphash
bf06985f2031c08da05742e19dae38a7- Authentihash MD5
a0e21c1aa62fb7cfa003b88b9e8cc7c2- Authentihash SHA1
f74723ee733f7d08e08b2c567806b575dd123b58- Authentihash SHA256
e38eb95fd1593c73311d426dbd85491494a4521aaa4c4ef66e02f7d6d0339171- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10