← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_4d8bc539.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_4d8bc539.sysSample 1 · HVCI TRUE
- MD5
cf42cc217c139298641901aad4e5db08- SHA1
01a606df49cc2ea19242519b51f7f17d2ba38be2- SHA256
4d8bc539ca7c72e552b7065d2a84fef43b75a46a53c82b50556c2984e0a86a9e- Imphash
d7ca9fd5bbf7e42108ec1b971ba58840- Authentihash MD5
cd675d9c1e9c0991690f08ab8bc50916- Authentihash SHA1
4e261a9ca84fd163618e13fe60739229af607d05- Authentihash SHA256
0dc9021f0c02e18f4c3357da42630adf515655b9473f93385c5c157efd5da4ac- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10