ca6455d1-b06e-496c-be33-f89c41b27540

CSAgent.sys

Description

ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.

UUID: ca6455d1-b06e-496c-be33-f89c41b27540
Created: 2025-03-26
Author: Michael Haag
Acknowledgement: |

Download Block

This download link contains the vulnerable driver!

Commands

sc.exe create 8492937_2_Driver.sys binPath=C:\windows\temp\8492937_2_Driver.sys type=kernel &amp;&amp; sc.exe start 8492937_2_Driver.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://www.elastic.co/security-labs/abyssworker

Known Vulnerable Samples

Property	Value
Filename
Creation Timestamp	2024-11-09 09:33:54
MD5	84414d0f2ab10d509580dd84d24e6708
SHA1	db76d3e42e3785cb166a758ebe41d0c739440c70
SHA256	b2ff9ef50ae037bb003d7157ea8da008a48f715a78c644b5f027b070bf5eb049
Authentihash MD5	a681f7f65cb88f074869b93b732a3dd1
Authentihash SHA1	1a76b65301253df32595414c17410770d073dc50
Authentihash SHA256	17a997feed57712f46558b4c99766d5b7722e1b095133b6b391a4743140e45de
RichPEHeaderHash MD5	ffdf660eb1ebf020a1d0a55a90712dfb
RichPEHeaderHash SHA1	3e905e3d061d0d59de61fcf39c994fcb0ec1bab3
RichPEHeaderHash SHA256	2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6
Company	CrowdStrike, Inc.
Description	CrowdStrike Falcon Sensor Driver
Product	CrowdStrike Falcon Sensor
OriginalFilename	CSAgent.sys

Download

Certificates

Expand

Certificate 039347e61dec6f6398d4d46bf732656c

Field	Value
ToBeSigned (TBS) MD5	117b82baec01ec954a12e1cc71378854
ToBeSigned (TBS) SHA1	e76f6e81798fd50243ce8ed567fb3e9270c19979
ToBeSigned (TBS) SHA256	aebf0489df031bf3af188cdd385a563567b5947b27a7528e8b77e271d3e36e33
Subject	C=CN, ST=, L=, O=, CN=
ValidFrom	2015-05-19 00:00:00
ValidTo	2016-05-18 23:59:59
Signature	e7ebf4db99ad928536737f426d837909d944c15b7fe162c0e457af0330bc3f45d91b2cf98d0d9a0f89617e68f599f667bc2fda16b4f121ec003b5f805a2fccda25b63c07de81d0261eeeafad4bac1c98c20e8afc4a6b56111da74f7b0c14c5a659d7c8fb82693a7ea1e2b4317d21c509e5a53083400dfbac315c1574c188864ef9db83c8c9893bd94095704c3b9df65f47d04a06a697acd037280b84a4b5f6870ee7ecc5993343f872dfd4f42eecac77bdab18eddf67938c8dd7c3e966e1051d1d487f91291952daa54847a8b23de3ee8a1a0ebe5b9de9f32126a2ae1279f4ff3bf57c5b0108e329260f6a08cd0735176f590ade1ded61fd01f4fda23cb239f3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	039347e61dec6f6398d4d46bf732656c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

FLTMGR.SYS
ntoskrnl.exe
HAL.dll
ntoskrnl.exe
HAL.dll

Imported Functions

Expand

FltGetVolumeInformation
wcscat_s
HalReturnToFirmware
NtQuerySystemInformation
ExAllocatePool
IoAllocateMdl
ExFreePoolWithTag
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
KeQueryPerformanceCounter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.:{`
.xu.
.i\6
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "039347e61dec6f6398d4d46bf732656c",
      "Signature": "e7ebf4db99ad928536737f426d837909d944c15b7fe162c0e457af0330bc3f45d91b2cf98d0d9a0f89617e68f599f667bc2fda16b4f121ec003b5f805a2fccda25b63c07de81d0261eeeafad4bac1c98c20e8afc4a6b56111da74f7b0c14c5a659d7c8fb82693a7ea1e2b4317d21c509e5a53083400dfbac315c1574c188864ef9db83c8c9893bd94095704c3b9df65f47d04a06a697acd037280b84a4b5f6870ee7ecc5993343f872dfd4f42eecac77bdab18eddf67938c8dd7c3e966e1051d1d487f91291952daa54847a8b23de3ee8a1a0ebe5b9de9f32126a2ae1279f4ff3bf57c5b0108e329260f6a08cd0735176f590ade1ded61fd01f4fda23cb239f3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=, L=, O=, CN=",
      "TBS": {
        "MD5": "117b82baec01ec954a12e1cc71378854",
        "SHA1": "e76f6e81798fd50243ce8ed567fb3e9270c19979",
        "SHA256": "aebf0489df031bf3af188cdd385a563567b5947b27a7528e8b77e271d3e36e33",
        "SHA384": "a4e88b4ff1274141196fea3636befba40efc5256df797e97fcc5e510d9736cd975e62dde0d6f098ac1f958a44755766c"
      },
      "ValidFrom": "2015-05-19 00:00:00",
      "ValidTo": "2016-05-18 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "039347e61dec6f6398d4d46bf732656c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2025-05-14