Driver intelligenceMaliciousVerified

daxin_blank4.sys

Driver used in the Daxin malware campaign.

UUID / f8bddc8b-49b9-41f7-a877-d15ec3f174f9ADDED / 2023-02-28AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

daxin_blank4.sysSample 1 · HVCI TRUE

MD5: 491aec2249ad8e2020f9f9b559ab68a8
SHA1: 8692274681e8d10c26ddf2b993f31974b04f5bf0
SHA256: 8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e
Imphash: ea37e43ffc7cfcba181c5cff37a9be1f
Authentihash MD5: f66f4d6b97b9e7b0e467daed2ed69bed
Authentihash SHA1: c8f227b45d27c43db4b661ef610efbfacfda8a75
Authentihash SHA256: 15b081ec83a89182b5bb0a642d56513f40810b5b0a42e904ab6d3fa8f34c0446
Machine: I386
Version: Not recorded
Publisher: n/a

sc.exe create daxin_blank4.sys binPath=C:\windows\temp\daxin_blank4.sys     type=kernel && sc.exe start daxin_blank4.sys

Elevate privileges · Privileges: kernel · OS: Windows 10