7394229455151a9cd036383027a1536b

MD5 of the Demodex kernel-mode rootkit driver published by Kaspersky in the September 2021 disclosure that originally named the actor `GhostEmperor` - the cluster now publicly tracked by U.S. agencies as Salt Typhoon. Loaded by bypassing Driver Signature Enforcement via the signed Cheat Engine driver `dbk64.sys`.

family

Demodex

first seen

Sep 29, 2021

publisher

Kaspersky (Securelist)