← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_fdd16a94.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_fdd16a94.sysSample 1 · HVCI TRUE
- MD5
154f30d81f67dcb5b855d4db6f26c8a6- SHA1
ffe5611f1f905f2caa4e846a51f31ef8856c95a2- SHA256
fdd16a94a71644a8bb52c4e0fbfecb93f04cfe37bd91bac599cf9abfb822762f- Imphash
f4feb75af58dedd4a6974281dcbffc60- Authentihash MD5
bcf297b1129b502de6ba2a3d0963cb78- Authentihash SHA1
88888c2d89015a3a354b9ca2c374bfb934bfe40d- Authentihash SHA256
75aa0f984fdc2d0e1db632b65fbec424a87a8c68a822fca1e503a269eba71f2d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_fdd16a94.sys binPath=C:\windows\temp\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sysElevate privileges · Privileges: kernel · OS: Windows 10