← Back to driver explorer
Driver intelligenceVulnerableVerified
fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys
The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sysSample 1 · HVCI FALSE
- MD5
fd3b7234419fafc9bdd533f48896ed73- SHA1
3784d1b09a515c8824e05e9ea422c935e693080c- SHA256
274340f7185a0cc047d82ecfb2cce5bd18764ee558b5227894565c2f9fe9f6ab- Imphash
28dc68bb6d6bf4f6b2db8dd7588b2511- Authentihash MD5
fea212edc50dd0f8f475d8cc5357db22- Authentihash SHA1
7ee97fb9318d44ef68529cf2b59b47e9c24760b7- Authentihash SHA256
cac6f11d37bf2438a7f07053bbe692bb135bc06c245b56e8411e3bd906e15f98- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys binPath=C:\windows\temp\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys type=kernel && sc.exe start fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sysElevate privileges · Privileges: kernel · OS: Windows 10