Driver intelligenceMaliciousVerified

ntbios.sys

Driver used in the Daxin malware campaign.

UUID / eef1fcf4-8c54-420b-8d38-9c5f95129dccADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ntbios.sysSample 1 · HVCI TRUE

MD5: 14580bd59c55185115fd3abe73b016a2
SHA1: 71469dce9c2f38d0e0243a289f915131bf6dd2a8
SHA256: 96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc
Imphash: a7bd820fa5b895fab06f20739c9f24b8
Authentihash MD5: dd3f6fe14dadb95f5d8c963006dec9d7
Authentihash SHA1: 2374491565e5798dccd4db2dc2af7e9bbefafd5b
Authentihash SHA256: 50f9323eaf7c49cfca5890c6c46d729574d0caca89f7acc9f608c8226f54a975
Machine: I386
Version: 5, 0, 2, 1
Publisher: n/a

sc.exe create ntbios.sys binPath=C:\windows\temp \n \n \n  tbios.sys type=kernel && sc.exe start ntbios.sys

Elevate privileges · Privileges: kernel · OS: Windows 10