Driver intelligenceMaliciousVerified

ndislan.sys

Driver used in the Daxin malware campaign.

UUID / ca1e8664-841f-4e4b-9e67-3f515cc249c6ADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ndislan.sysSample 1 · HVCI TRUE

MD5: 47e6ac52431ca47da17248d80bf71389
SHA1: d417c0be261b0c6f44afdec3d5432100e420c3ed
SHA256: b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427
Imphash: 70e1caa5a322b56fd7951f1b2caacb0d
Authentihash MD5: 8bddebd3670d9f154318afd62195a2b8
Authentihash SHA1: 7f57424f2ce7186e3a1951f3710f28d7ce9c8a96
Authentihash SHA256: 9345c3af554c06aa949492f1642a7a03404956d2952cca8a68658b62dccb0825
Machine: AMD64
Version: 6.1.7600.1421
Publisher: Anhua Xinda (Beijing) Technology Co., Ltd.

sc.exe create ndislan.sys binPath=C:\windows\temp \n \n \n  dislan.sys type=kernel && sc.exe start ndislan.sys

Elevate privileges · Privileges: kernel · OS: Windows 10