Analysis of a Signed Silver Fox Group AV/EDR Killer Kernel Driver

by duckie · 10 aug 2026

A small 64-bit Windows kernel driver (driver.sys) was analyzed. Despite being code-signed by CR Connect (Tokyo) LLP, it functions as a straightforward AV/EDR process killer.

Hashes:

• MD5: 082d3d846d5cb54fc9e4cbf39684ddd8
• SHA-256: 1c11266cd05c7da6d7a1208cc7ce9fbbc0aa93e47b79e5e3d7b5be855708f94d

File size is approximately 14.6 KB and the binary is not packed (entropy ≈ 6.8).

DriverEntry : 0x140001450

The entry point performs the following actions:

1. Initializes the device name \Device\EraseStringCode (RtlInitUnicodeString at 0x140001469)
2. Creates the device object via IoCreateDevice at 0x140001499
3. Initializes the symbolic link \DosDevices\EraseStringCode (RtlInitUnicodeString at 0x1400014B3)
4. Creates the symbolic link via IoCreateSymbolicLink at 0x1400014C3
5. Sets DO_BUFFERED_IO
6. Registers the IRP_MJ_DEVICE_CONTROL dispatch routine to 0x1400013C0
7. Sets the unload routine to 0x140001590
8. Starts a system thread pointing to 0x140001000 using PsCreateSystemThread (call site at 0x140001535)
9. Sets a global run flag (DAT_140003010 = 1)

The Killer Thread : 0x140001000

This is the core malicious logic. The thread runs in a continuous loop:

• Sleeps for approximately 3 seconds using KeDelayExecutionThread
• Calls ZwQuerySystemInformation (SystemProcessInformation class) to enumerate running processes
• Compares each process name against a hardcoded list of security products using _wcsicmp
• On a match, calls actuall_kill_the_process at 0x14000133C

Targeted processes include:

• Microsoft Defender family: MsMpEng, NisSrv, SecurityHealthService, SecurityHealthHost, SecurityHealthSystray, MpDefenderCoreService, smartscreen, MpCmdRun
• 360 products: 360tray, 360sd, 360Safe, 360rps, 360rp
• Huorong / Hips: HipsDaemon, HipsMain, HipsTray
• QQ / Tencent: QQPCTray, QQPCRTP
• Others: AvastSvc, AVGSvc, bdservicehost (Bitdefender), 2345Softmgr*, MSPCManager*, ZhuDongFangYu, and more

Memory allocations use the pool tag 'Kill'.

Process Termination Routine : 0x14000133C (actuall_kill_the_process)

PsLookupProcessByProcessId(pid, &Process);
ObOpenObjectByPointer(...);
ZwTerminateProcess(handle, 0);
ZwClose(handle);
ObfDereferenceObject(Process);

The routine is simple and relies entirely on documented NT kernel APIs.

IOCTL Handler : 0x1400013C0 (kill_the_process_func)

Handles IOCTL code 0x89815C.

When the input buffer contains a 4-byte process ID, it calls actuall_kill_the_process. This allows user-mode code to request termination of arbitrary processes through the driver.

Unload Routine : 0x140001590

Performs clean teardown:

• Sets the run flag DAT_140003010 = 0
• Waits for the killer thread to exit (KeWaitForSingleObject)
• Deletes the symbolic link and device object

Assessment

This is a defense-evasion tool rather than a full rootkit. It relies on:

• A code-signing certificate issued to “CR Connect (Tokyo) LLP”
• Documented NT kernel APIs
• Simple process-name matching

No advanced techniques such as hooks, DKOM, or stealth mechanisms beyond the signature are present. The device name \Device\EraseStringCode is distinctive.

The strong focus on Chinese security products combined with Microsoft Defender components is consistent with tools commonly seen in Chinese-speaking cybercrime ecosystems.