647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c
- SHA256 647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rootkit/RunAsAdmin.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
rootkit/RunAsAdmin.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
rootkit/lrkndrv.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
rootkit/lrkndrv.sys
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c
- Size 266KB
- Sample260717-a77baagy9k
- SHA256 647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c
- MD5 b874391f6c0122142d3891b5d9fc37e5
- SHA1 1c11f7a44b03af6e96698bffde9a0bc07ce5cea4
- SHA512 76668f8ab2f997fe4c8cb013cf355909864d1f9ee8430054113bb48c58ed37b9a0c3a5bf403037f3b2044fc3d192c86b728c27326d7c2717b805e6e7912234a7
- SSDEEP 6144:pQ0nytr+ee96NZzRz3JzX3gNYxyyfMioYThUYPiLqLwzXYE:esI1e0zRNzX3gJDiTxPiLq+XP
- TLSH T1994413A0568BF775C8C3D3ECB22C136D78CD4086E46F74972B8DD19B8B288F1069599B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/rootkit/lrkndrv.sys
File Explorer
-
647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c.zip 266KB
-
rootkit/RunAsAdmin.bat213B
-
rootkit/lrkndrv.sys.sys 53KB
-
rootkit/soft.reg2.1MB
rootkit/RunAsAdmin.bat
- SHA256 6d9b8c1ed1c512d747f3f4996c1d99c1c0cf0559e9f5538cb8c11b2613d5a297
- MD5 0070056d35edeb1b22b078e29b86a5a4
- SHA1 69cf9e268bb4138e2f71668d69aa26640e00f987
- SHA512 a0abe59a07b5840030e100a9c62585696663be4dfe20d5e160a9e583fca0e1655e4b605d914c5f232bd49df02c11b841a198c9458c793bc8c86e40b79ddd4810
- TLSH T188D0220387C0A70331994D02E20B6C347D32753C89BA20A0CF4D72C4E00829E8370FF5
- MD5 SHA1 SHA512 TLSH
rootkit/lrkndrv.sys
- IMPHASH 41d1cc026adfeec085e1e242a860870b
- SHA256 d5c802f22d13db85a2271978762e2db288d688672ab40bd2712aa5159d27e39e
- MD5 dd4e32a23d031d41454f8e5f2b47dd9e
- SHA1 d9e00c3038717aaa9518c82bb0be221e1afe99c9
- SHA512 baf4d2833a4168cd2c169bce2a6b7de11b8b4d4c05cd063551fc3ee43c9100ccf497c569b7919619deafeb9806510eb42c2e27d32a85911a116b67211bd611e5
- SSDEEP 1536:oO3hL6iqeOdwL+ocrwsFOjHb1rFL/XImLhzNLFJWXSoCnYDfqx62+kBMzdHA:oORL6PeOwL+ocrwsFOjHb1rFL/XImLh3
- TLSH T11433F94F245E16BCE442917AC1D3D0A6F670318A0332A7CF8AE9B5686E13DE5B335B53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
66:78:13:3e:f2:bd:2a:b2:f3:e5:ff:91:58:6c:d4:16:d4:97:1e:9f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Changlang Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Changlang Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN
Chains
Jul 10, 2026
CN=Beijing Changlang Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Changlang Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN
Subject
CN=Beijing Changlang Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Changlang Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN
Serial Number
27:a6:89:2f:4f:db:a5:2e:d7:db:c4:07:f2:fd:25:ba
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2011 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
6
Entry point
37072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
ExReleaseRundownProtection
MmProbeAndLockPages
MmUnlockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
ZwAllocateVirtualMemory
KeInitializeApc
KeInsertQueueApc
KeTestAlertThread
wcsstr
_wcsicmp
RtlInitUnicodeString
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeWaitForSingleObject
CmRegisterCallbackEx
CmCallbackGetKeyObjectID
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateFile
IoCreateSymbolicLink
IoDeleteDevice
IoFreeIrp
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwClose
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwSetValueKey
PsSetCreateProcessNotifyRoutineEx
ZwTerminateProcess
ZwOpenProcess
ZwQuerySystemInformation
ZwQueryInformationProcess
__chkstk
wcslen
IoFileObjectType
PsThreadType
ExInitializeRundownProtection
ZwQueryValueKey
RtlCompareMemory
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ObReferenceObjectByName
__C_specific_handler
IoDriverObjectType
ExAcquireFastMutex
ExReleaseFastMutex
ObRegisterCallbacks
PsGetCurrentProcessId
PsGetProcessId
IoThreadToProcess
PsProcessType
MmGetSystemRoutineAddress
ExAcquireRundownProtection
PsGetCurrentThreadId
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PsGetProcessWow64Process
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=35215,
count=1, id=260, version=35215,
count=3, id=257, version=35215,
count=75, id=1, productName=Unmarked objects,
count=6, id=261, version=35228,
count=1, id=258, version=35228,
rootkit/soft.reg
- SHA256 6b5be12f0d7c779867151abf8980a2125638c5fd3383aa6b65d4e7f2913f45bb
- MD5 e98012e84092d11091439bdc86e26e70
- SHA1 ba8e21dedb68598cd8e10b9a48644141e4230480
- SHA512 047ee95c71e2fbc416da6ff77f3c5a603eb9d9add9d3fdb27fd2043c252c6062a199569481a4bb15694d0093cff26e62608d758380dfb4095e8c438cb3d03792
- SSDEEP 3072:dnEAUMiLUiOrLYSnJLv+tOydsJdivLktOqO5ACNagROE0yfVl6jcSRdEMZNJcdSS:W
- TLSH T15EA5673ACB79155742B38D78CEE783A7AE572407332CD84A588327810D93E5F789636E
- MD5 SHA1 SHA512 SSDEEP TLSH