Analysis of a Signed Silver Fox Group AV/EDR Killer Kernel Driver | reverser.space
A small 64-bit Windows kernel driver (driver.sys) was analyzed. Despite being code-signed by CR Connect (Tokyo) LLP, it functions as a straightforward AV/EDR process killer.
https://app.reverser.space/p/duckie/silver-fox-group-rootkit-2026#0x140001450
🎖@malwr
reverser.space
Analysis of a Signed Silver Fox Group AV/EDR Killer Kernel Driver | reverser.space
A small 64-bit Windows kernel driver (driver.sys) was analyzed. Despite being code-signed by **CR Connect (Tokyo) LLP**, it functions as a straightforward AV/EDR process killer.
August 30, 2026 342 8
