← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_a6deeea6.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_a6deeea6.sysSample 1 · HVCI TRUE
- MD5
8dfe2b95d7aa30285220bac35450cc3a- SHA1
a897b159814a3d61de5dcc0077b2e07bbd6e2711- SHA256
a6deeea6607a7da9c8b4087d1424aac6dbbe70831e93c835b5a9e4a80ae59f28- Imphash
96861132665e8d66c0a91e6c02cc6639- Authentihash MD5
ddfe4092e284607758fb6f84bc0790fb- Authentihash SHA1
68ac771380af33171823835a9c3d9a491da1b5c2- Authentihash SHA256
65205e494d01e07c27da9a623ee5edad33dbcedc755ef5155b19cb2e908cf185- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_d9f15d91.sys binPath=C:\windows\temp\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sysElevate privileges · Privileges: kernel · OS: Windows 10