LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceMaliciousUnverified

fgme.sys

BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.

UUID / d3111e83-52eb-4a8c-817d-761ea72d37e2ADDED / 2023-06-05AUTHOR / Guus Verbeek

The project has not confirmed this driver's sample hashes.

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

fgme.sysSample 1 · HVCI TRUE
SHA1
0bec69c1b22603e9a385495fbe94700ac36b28e5
Machine
Not recorded
Version
Not recorded
Publisher
Not recorded

Recorded command

sc.exe create fgme.sys binPath=C:\windows\temp\fgme.sys type=kernel && sc.exe start fgme.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references