vrtaucbl[.]sys

Sharing

Copy URL

Twitter E-mail

General

Target

vrtaucbl.sys
Size

174KB
MD5

425a203589320aa5b0070ed7428d0b84
SHA1

d54d4a54f65ffbb7ddf2ca500bd6c50ae74a2c13
SHA256

3370b480c669265eb3a84d78a080ac02cb1f2ef403de56408df064fc47d6af77
SHA512

fde10940a5f7f6aae33213a425f39938975850f833eba3d0d790ed66d44e79b61c59179b06a0d55c9677c307e1e48619add495dad139f6cc8508d37ae8e352c9
SSDEEP

3072:e2hnhfuwgmq5fZwJCI8GU3rbP3sFxqZYmP0J709:exm+SCI8B3vP3sFxqZPp9

Score

1^/10

Malware Config

Signatures

Files

vrtaucbl.sys
.sys windows:6 windows x86 arch:x86

fa5c24a3900f8e99f3eea23504d75c74

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26-05-2020 12:18

Not After

26-08-2023 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-03-2020 17:31

Not After

05-03-2021 17:31

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-10-2014 20:31

Not After

15-10-2029 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c
Signer

Actual PE Digest

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c

Digest Algorithm

sha256

PE Digest Matches

true

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c
Signer

Actual PE Digest

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vrtaucbl.pdb

Imports

ntoskrnl.exe

MmFreePagesFromMdl
MmUnmapLockedPages
wcschr
IoGetCurrentProcess
memset
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdl
KeInitializeEvent
KeWaitForSingleObject
RtlFreeUnicodeString
IoRegisterDeviceInterface
ZwClose
IoSetDeviceInterfaceState
wcsncpy
_wcsnicmp
srand
IofCompleteRequest
ProbeForRead
ProbeForWrite
wcsrchr
InterlockedExchange
IoReleaseCancelSpinLock
ObfDereferenceObject
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoOpenDeviceInterfaceRegistryKey
KeCancelTimer
ExSetTimerResolution
KeSetTimer
ExFreePool
KeSetEvent
KeInitializeDpc
KeInitializeTimerEx
RtlFillMemory
wcsncmp
KeGetCurrentThread
KeWaitForMultipleObjects
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlZeroMemory
RtlUnwind
KeSetSystemAffinityThread
PsInitialSystemProcess
MmGetPhysicalAddress
PsGetCurrentProcessId
PsGetCurrentThreadId
ZwQueryInformationProcess
ZwQuerySystemInformation
MmUnmapViewInSystemSpace
MmMapViewOfSection
MmUnmapViewOfSection
MmMapViewInSystemSpace
MmCreateSection
KdDebuggerEnabled
KeNumberProcessors
ExAllocatePool
MmGetSystemRoutineAddress
KeClearEvent
memcpy
RtlCompareUnicodeString
RtlMoveMemory
KeInitializeMutex
KeReleaseMutex
KeInitializeSpinLock
RtlInitUnicodeString
KeQueryInterruptTime
RtlGetVersion

hal

KfLowerIrql
KfAcquireSpinLock
KfRaiseIrql
KfReleaseSpinLock
KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcRegisterPhysicalConnection
PcNewPort
PcRegisterSubdevice
PcInitializeAdapterDriver
PcAddAdapterDevice
PcDispatchIrp
PcRegisterAdapterPowerManagement

ks.sys

KsAcquireResetValue
KsProbeStreamIrp

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 49B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa5c24a3900f8e99f3eea23504d75c74

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3aCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9cSigner

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

portcls.sys

ks.sys

Sections

.text Size: 90KB - Virtual size: 89KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 1000B

PAGE Size: 512B - Virtual size: 49B

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 44KB - Virtual size: 44KB

.reloc Size: 4KB - Virtual size: 4KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c
Signer

ab:d6:6d:3c:af:af:16:28:db:0c:55:71:d4:ea:92:9c:0a:04:09:df:96:d7:b7:ba:6b:74:15:2b:c7:45:be:9c
Signer

.text
Size: 90KB - Virtual size: 89KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 1000B

PAGE
Size: 512B - Virtual size: 49B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 44KB - Virtual size: 44KB

.reloc
Size: 4KB - Virtual size: 4KB