SoarCheats[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

SoarCheats.sys
Size

14KB
MD5

b72f371ad3bb5f7d31a85c8e0b954967
SHA1

82197bdad96e0766bed6efe3a838a61e274e5890
SHA256

6b7252ca4e1ec3415c3e23c12ccb118526371c25bf6b79f3c9e272d575035dbe
SHA512

c9aaa07dc305c59e2a628053035c6dd2e339f4189ed554c7358e680cd0c77053fc5b08364cf6f3b5152c619070f8ad3e37e47ba01960199a116dea702be6d83d
SSDEEP

192:h+OfoLvwUpu/Yc40MrHlT/CQHUrWOB/gfH0JOqsmVgz28WhBqTMy0:h+Xw2u/5KtzYWOZg8JN77hhSY

Score

1^/10

Malware Config

Signatures

Files

SoarCheats.sys
.sys windows:10 windows x64 arch:x64

48aab8b485505e39221c6ac40909a9cb

Code Sign

88:67:8b:a4:b6:e5:96:72:79:6c:34:bc:a8:85:6d:b0
Certificate

Issuer

CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

08/02/2024, 05:00

Not After

11/08/2029, 03:59

Subject

CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:4e:7e:65:1d:ca:39:26:01:06:bb:5f:1e:8a:24:07:ff:96:d7:62:c7:8d:6e:28:6e:dd:0a:b5:bc:eb:67:35
Signer

Actual PE Digest

84:4e:7e:65:1d:ca:39:26:01:06:bb:5f:1e:8a:24:07:ff:96:d7:62:c7:8d:6e:28:6e:dd:0a:b5:bc:eb:67:35

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\soare\Documents\neutron.win\NeutronDriver\x64\Release\SkarxVeruDriver.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlGetVersion
ExAllocatePool
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
IoCreateDriver
PsGetProcessSectionBaseAddress
ZwQuerySystemInformation

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48aab8b485505e39221c6ac40909a9cb

Code Sign

88:67:8b:a4:b6:e5:96:72:79:6c:34:bc:a8:85:6d:b0Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

84:4e:7e:65:1d:ca:39:26:01:06:bb:5f:1e:8a:24:07:ff:96:d7:62:c7:8d:6e:28:6e:dd:0a:b5:bc:eb:67:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 48B

.pdata Size: 512B - Virtual size: 216B

INIT Size: 1024B - Virtual size: 568B

.reloc Size: 512B - Virtual size: 20B

88:67:8b:a4:b6:e5:96:72:79:6c:34:bc:a8:85:6d:b0
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

84:4e:7e:65:1d:ca:39:26:01:06:bb:5f:1e:8a:24:07:ff:96:d7:62:c7:8d:6e:28:6e:dd:0a:b5:bc:eb:67:35
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 48B

.pdata
Size: 512B - Virtual size: 216B

INIT
Size: 1024B - Virtual size: 568B

.reloc
Size: 512B - Virtual size: 20B