vrtaucbl[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

vrtaucbl.sys
Size

201KB
MD5

689947fc3909636ec0ec2ab34e064a69
SHA1

1572085cc79da0421ca45f923e1172a1519195ae
SHA256

94cd47cc1923a74a4c362586a2336f9f8fc365c6395d61db63dd615dba6fd915
SHA512

9f85129fbed6ba1ad33c3f4197e1085aaefb088793a6146cb812460c358964228ac452cd5708c9d695a2e12b506992eb76cf68b65c5948d0e66c12f3ed0cc29c
SSDEEP

3072:PptdTvHspKddWm/cl4vndSTODR5ik84vZK969vTuGw/+9/P/ziokqhgQ2L0Yq:PpTsYlcanBC4S61xwM/TiVqCUf

Score

1^/10

Malware Config

Signatures

Files

vrtaucbl.sys
.sys windows:6 windows x64 arch:x64

68977b7d7f9d5b027fe2e2ae911b36b0

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:31

Not After

05/03/2021, 17:31

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d
Signer

Actual PE Digest

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d

Digest Algorithm

sha256

PE Digest Matches

true

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d
Signer

Actual PE Digest

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vrtaucbl.pdb

Imports

ntoskrnl.exe

MmFreePagesFromMdl
MmUnmapLockedPages
wcschr
IoGetCurrentProcess
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdl
KeInitializeEvent
KeWaitForSingleObject
RtlFreeUnicodeString
IoRegisterDeviceInterface
ZwClose
IoSetDeviceInterfaceState
__C_specific_handler
wcsncpy
_wcsnicmp
srand
IofCompleteRequest
ProbeForRead
ProbeForWrite
wcsrchr
IoReleaseCancelSpinLock
ObfDereferenceObject
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwOpenKey
ZwCreateKey
__chkstk
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoOpenDeviceInterfaceRegistryKey
memcmp
KeCancelTimer
ExFreePool
KeSetTimer
KeSetEvent
KeInitializeDpc
KeInitializeTimerEx
wcsncmp
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlCompareUnicodeString
RtlZeroMemory
RtlMoveMemory
KeSetSystemAffinityThread
PsInitialSystemProcess
MmGetPhysicalAddress
PsGetCurrentProcessId
PsGetCurrentThreadId
ZwQueryInformationProcess
ZwQuerySystemInformation
MmUnmapViewInSystemSpace
MmMapViewOfSection
MmUnmapViewOfSection
MmMapViewInSystemSpace
MmCreateSection
RtlFillMemory
KdDebuggerEnabled
KeNumberProcessors
ExAllocatePool
MmGetSystemRoutineAddress
KeClearEvent
KeWaitForMultipleObjects
ExSetTimerResolution
RtlInitUnicodeString
KeInitializeMutex
KeReleaseMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlGetVersion

hal

KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcRegisterPhysicalConnection
PcNewPort
PcRegisterSubdevice
PcInitializeAdapterDriver
PcAddAdapterDevice
PcDispatchIrp
PcRegisterAdapterPowerManagement

ks.sys

KsAcquireResetValue
KsProbeStreamIrp

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 50B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68977b7d7f9d5b027fe2e2ae911b36b0

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3aCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2dSigner

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

portcls.sys

ks.sys

Sections

.text Size: 105KB - Virtual size: 105KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 1KB

.pdata Size: 6KB - Virtual size: 6KB

PAGE Size: 512B - Virtual size: 50B

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 44KB - Virtual size: 44KB

.reloc Size: 1KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d
Signer

43:2a:c3:df:c0:1e:ac:9c:35:05:19:29:c6:b2:6f:2c:9d:16:1d:6b:31:82:ec:e5:4e:4c:59:38:35:06:be:2d
Signer

.text
Size: 105KB - Virtual size: 105KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 1KB

.pdata
Size: 6KB - Virtual size: 6KB

PAGE
Size: 512B - Virtual size: 50B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 44KB - Virtual size: 44KB

.reloc
Size: 1KB - Virtual size: 1KB