ed3abb66-c577-44b8-89fa-80d300c82373

xhunter2.sys :inline

Description

Wellbia xhunter2.sys version 2026.6.1.192 is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-15430. Public research demonstrates bypasses for its module, caller, and request authentication layers, exposing privileged command paths for cross-process memory access, protected-process handle creation, process termination, local privilege escalation, and kernel-assisted code injection.

  • UUID: ed3abb66-c577-44b8-89fa-80d300c82373
  • Created: 2026-08-28
  • Author: Michael Haag
  • Acknowledgement: BlackSnufkin | @BlackSnufkin42

Download

This download link contains the vulnerable driver!

Block xhunter2.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create xhunter2 binPath= C:\windows\temp\xhunter2.sys type= kernel && sc.exe start xhunter2
Use CasePrivilegesOperating System
Impair security processes and access protected process memory through privileged kernel command paths.kernelWindows 10, Windows 11

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://blacksnufkin.github.io/posts/Hunting-the-Hunter-II/
  • https://github.com/BlackSnufkin/AxHunter
  • https://www.cve.org/CVERecord?id=CVE-2026-15430

    • CVE

  • CVE-2026-15430

    • Known Vulnerable Samples

    PropertyValue
    Filenamexhunter2.sys
    Creation Timestamp2026-06-01 01:35:20
    MD59976ae79fb3887e0243dc159b2b68a48
    SHA1fb2dc9c59b8dfcf040b42f7d5eb41eb7b12852fb
    SHA25644cefb0b3b6516e6731de09a3e2e0eb8b98b02cc3fdf7bb4b22680e93f3cde1e
    Authentihash MD52e89c3f2aed10a71f7d1dcf16c711fe0
    Authentihash SHA1943f317e5ef8fcff293e959ec1a57d1a66dfe3e4
    Authentihash SHA2563c92a1df7bb856afaef29216533b1d407408bfc4c6236961eb2b769c205f936f
    RichPEHeaderHash MD5
    RichPEHeaderHash SHA1
    RichPEHeaderHash SHA256
    CompanyWellbia.com Co., Ltd.
    DescriptionWellbia.com System Guard
    ProductWellbia.com System Guard
    OriginalFilenamexhunter1.sys

    Download

    Certificates

    Expand
    Certificate 08ad40b260d29c4c9f5ecda9bd93aed9
    FieldValue
    ToBeSigned (TBS) MD55d8003a64dfa5a4d88365da1566038cb
    ToBeSigned (TBS) SHA179465b56bc7ad55a37bdf633943da8bfc84db228
    ToBeSigned (TBS) SHA25684bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332
    SubjectC=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    ValidFrom2021-04-29 00:00:00
    ValidTo2036-04-28 23:59:59
    Signature3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber08ad40b260d29c4c9f5ecda9bd93aed9
    Version3
    Certificate 05d5c8c98ae5547b352ea1861bc7a61f
    FieldValue
    ToBeSigned (TBS) MD56a52a903261459fbd47e0591ab8572e0
    ToBeSigned (TBS) SHA131ff51a1fddc77381767e844743d17288377d27e
    ToBeSigned (TBS) SHA256dada17fc5f5f4835fbb3bdefc41a706baf10de685aa6e6492388f58605e7fc5d
    SubjectJURISDICTION_OF_INCORPORATION_C=KR, JURISDICTION_OF_INCORPORATION_SP=Seoul, BUSINESS_CATEGORY=Private Organization, serialNumber=110111,3525536, C=KR, ST=Seoul, L=Geumcheon District, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.
    ValidFrom2026-04-29 00:00:00
    ValidTo2027-04-28 23:59:59
    Signature8171796de4d7f5a8227e192b7eeb7cc68ae96d4566d199e29879598d9f45afe264e6bf47b15727d46fea0eb4725cd9dbb8664236609283ef1bf3a9d161afba599cc1120d80e8512eee3d37e1fef715b967b4260c9cff2ea8073eaae0dbed1492c13bf506dc8c8c798cf1e0d66e5a34ff3a0cea94cff78b72b2909add08171304d0d7797b624759869c2186e6aa265ccbdfb02e002697c9ba50d28adc1a84d0df00f94b4424aa6d8f5ab657ce0a18d61d0f4b969f8fab103ad3e3c176db00dc6ddde9542f0b91a0118825605faa881b64813329a81400258e35dacaf3cab5c2e21c21085886aa06d9fedbbba05b5aaf99001abca272ffb80caf3f9fc5cfd7a90d3e32cabdd0483a3ad0e934b5ba26cebe5f0f277234f7e0cb586cfcd031397b59fc0b48a11bb43af9dbc935f48468d8483f9bcddb86c371a40217ad01cea59202b6e96f6782efb3bb58b00c1e3912609387bf533d238ccf36f991d9a0ed6d23b8d24c2b151b71dea2da7e4a802bd018be43f981e3b89053b2d7962fa09d4f728fa5999c775c6237d1dca69a2c79da987df05e8c0917ee83f373ce828f1d93ef14d2db8a39749c0f44f90b4ba392852257a1540109d01a9e1a2ad1ad1502e92afcaffe87a4d60efaf86ae307e52b73d1a406591a609bbe7f821a3476932eb62579089fdb83543046dbe91dd8f6a0c9f0bbe6a97dcc9fda4c544c69ea4c36c7b2d8
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber05d5c8c98ae5547b352ea1861bc7a61f
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • ZwClose
    • ObOpenObjectByPointer
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • ZwWaitForSingleObject
    • PsGetProcessSectionBaseAddress
    • __C_specific_handler
    • PsProcessType
    • RtlCompareMemory
    • ExFreePoolWithTag
    • ProbeForRead
    • IoGetCurrentProcess
    • ObfReferenceObject
    • ObfDereferenceObject
    • ZwCreateFile
    • ZwReadFile
    • PsGetCurrentProcessId
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ZwQueryVirtualMemory
    • _vsnprintf
    • MmHighestUserAddress
    • wcsrchr
    • ExAllocatePoolWithTag
    • ObReferenceObjectByHandle
    • ZwOpenFile
    • MmSecureVirtualMemory
    • ObReferenceObjectByName
    • ZwQueryInformationProcess
    • ObSetHandleAttributes
    • IoFileObjectType
    • IoDriverObjectType
    • KeReleaseMutex
    • KeWaitForSingleObject
    • MmIsAddressValid
    • PsLookupProcessByProcessId
    • PsLookupThreadByThreadId
    • IoThreadToProcess
    • PsThreadType
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • MmUnmapLockedPages
    • IoAllocateMdl
    • IoFreeMdl
    • PsSetLoadImageNotifyRoutine
    • PsRemoveLoadImageNotifyRoutine
    • RtlCompareUnicodeString
    • DbgPrint
    • ZwQueryValueKey
    • RtlPrefixUnicodeString
    • PsGetProcessId
    • KeEnterGuardedRegion
    • KeLeaveGuardedRegion
    • _stricmp
    • MmProtectMdlSystemAddress
    • ZwQuerySystemInformation
    • KeInitializeEvent
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • ZwOpenSection
    • ZwMapViewOfSection
    • ZwUnmapViewOfSection
    • KeSetEvent
    • ExQueryDepthSList
    • ExpInterlockedPopEntrySList
    • ExpInterlockedPushEntrySList
    • RtlInitUnicodeString
    • ExDeleteNPagedLookasideList
    • IoCreateNotificationEvent
    • _wcsnicmp
    • RtlEqualUnicodeString
    • KeInitializeMutex
    • PsSetCreateProcessNotifyRoutine
    • RtlCopyUnicodeString
    • KeAreAllApcsDisabled
    • ProbeForWrite
    • IoGetTopLevelIrp
    • ZwQueryInformationFile
    • ObQueryNameString
    • PsLookupProcessThreadByCid
    • PsGetProcessInheritedFromUniqueProcessId
    • ZwQueryInformationThread
    • MmSystemRangeStart
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ZwUnloadDriver
    • RtlInitAnsiString
    • RtlAnsiStringToUnicodeString
    • PsGetVersion
    • RtlFreeUnicodeString
    • KeEnterCriticalRegion
    • KeLeaveCriticalRegion
    • RtlImageNtHeader
    • ExAcquireResourceSharedLite
    • ExAcquireResourceExclusiveLite
    • ExReleaseResourceLite
    • ZwOpenProcess
    • ZwDuplicateObject
    • PsAcquireProcessExitSynchronization
    • PsReleaseProcessExitSynchronization
    • PsGetProcessImageFileName
    • PsIsSystemProcess
    • strcmp
    • PsInitialSystemProcess
    • PsLoadedModuleList
    • PsSetCreateProcessNotifyRoutineEx
    • RtlEnumerateGenericTableAvl
    • ExAcquireSpinLockExclusive
    • ExReleaseSpinLockExclusive
    • KeBugCheckEx
    • MmGetSystemRoutineAddress
    • ExInitializeNPagedLookasideList
    • KeQueryPerformanceCounter

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .E!z
    • .reloc
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "05d5c8c98ae5547b352ea1861bc7a61f",
      "Signature": "8171796de4d7f5a8227e192b7eeb7cc68ae96d4566d199e29879598d9f45afe264e6bf47b15727d46fea0eb4725cd9dbb8664236609283ef1bf3a9d161afba599cc1120d80e8512eee3d37e1fef715b967b4260c9cff2ea8073eaae0dbed1492c13bf506dc8c8c798cf1e0d66e5a34ff3a0cea94cff78b72b2909add08171304d0d7797b624759869c2186e6aa265ccbdfb02e002697c9ba50d28adc1a84d0df00f94b4424aa6d8f5ab657ce0a18d61d0f4b969f8fab103ad3e3c176db00dc6ddde9542f0b91a0118825605faa881b64813329a81400258e35dacaf3cab5c2e21c21085886aa06d9fedbbba05b5aaf99001abca272ffb80caf3f9fc5cfd7a90d3e32cabdd0483a3ad0e934b5ba26cebe5f0f277234f7e0cb586cfcd031397b59fc0b48a11bb43af9dbc935f48468d8483f9bcddb86c371a40217ad01cea59202b6e96f6782efb3bb58b00c1e3912609387bf533d238ccf36f991d9a0ed6d23b8d24c2b151b71dea2da7e4a802bd018be43f981e3b89053b2d7962fa09d4f728fa5999c775c6237d1dca69a2c79da987df05e8c0917ee83f373ce828f1d93ef14d2db8a39749c0f44f90b4ba392852257a1540109d01a9e1a2ad1ad1502e92afcaffe87a4d60efaf86ae307e52b73d1a406591a609bbe7f821a3476932eb62579089fdb83543046dbe91dd8f6a0c9f0bbe6a97dcc9fda4c544c69ea4c36c7b2d8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "JURISDICTION_OF_INCORPORATION_C=KR, JURISDICTION_OF_INCORPORATION_SP=Seoul, BUSINESS_CATEGORY=Private Organization, serialNumber=110111,3525536, C=KR, ST=Seoul, L=Geumcheon District, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.",
      "TBS": {
        "MD5": "6a52a903261459fbd47e0591ab8572e0",
        "SHA1": "31ff51a1fddc77381767e844743d17288377d27e",
        "SHA256": "dada17fc5f5f4835fbb3bdefc41a706baf10de685aa6e6492388f58605e7fc5d",
        "SHA384": "cff132037cc82be91998d5dc0a0cd2cd314b0bc4f00f0fac0f9fb11f499440abe486226d2c254b4dd3e59f5fc6669e5b"
      },
      "ValidFrom": "2026-04-29 00:00:00",
      "ValidTo": "2027-04-28 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "05d5c8c98ae5547b352ea1861bc7a61f",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31