58 ms·
It was a binary data file (supposedly invalid) that caused the actual CS driver component to BSOD. However, they used the „sys“ suffix to make it look just like
by G3rn0ti 2y ago
It was a binary data file (supposedly invalid) that caused the actual CS driver component to BSOD. However, they used the „sys“ suffix to make it look just like a driver supposedly to get Windows protection from a malicious actor to just delete it. AFAIU.
- stevekemp 2y agoWindows filesystem protection doesn't rely upon the filename, but on the location. They could have named their files "foo.cfg", "foo.dat", "foo.bla" and been equally protected. The use of ".sys" here is probably related to the fact it is used by their system driver. I don't think anybody was trying to pretend the files there are system drivers themselves, and a quick look at the exports/disassembly would make that apparent anyway.