Skip to content

iocs.md

Latest commit

 

History

History
65 lines (53 loc) · 2.64 KB

iocs.md

File metadata and controls

65 lines (53 loc) · 2.64 KB
Raw

Indicators of Compromise — CVE-2025-61155

File: vulnerable driver

Type Value
File name (original) GameDriverX64.sys
Known in-the-wild rename UpdateCheckerX64.sys (Interlock)
SHA-256 9DDAE47FF968343A8C32A5344060257FDC08E2A7BDB9A227C8B3A584EE3C9F1E
MD5 8f0577d28c4ff5f71b149f444bfaba8e
Size 57,552 bytes
Version 7.23.04.07 (vulnerable: <= 7.23.4.7)
Code-signing subject Fedeen Games Limited (Hong Kong)
Signing CA DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

Match on content/hash, not file name — the driver is dropped under multiple names. The Authenticode signature is valid, so signature presence alone is not a clean signal; pivot on the signer subject + hash.

Host artefacts

Artefact Value
Device object \Device\HtAntiCheatDriver
Symbolic link \??\HtAntiCheatDriver (user-mode \\.\HtAntiCheatDriver)
Loaded "verification" DLLs (name-only) QmGUI.dll, QmGUI4.dll, gameuirender.dll
Pool tag mpr1 (0x3172706D)
Debug string term is coming
Leaked PDB path E:\PWRD\AntiCheatGit\HtDriver2.0_maomx\output\x64_Release\PwrdDriver\app\PwrdDriver.pdb

Behavioural / exploit signals

  • A non-anti-cheat process opening a handle to \\.\HtAntiCheatDriver.
  • DeviceIoControl with control code 0x222040 (or the 0x2220xx family) to that device, with an 8-byte input buffer beginning with 56 34 12 FA.
  • A user process that LoadLibrarys a module named QmGUI.dll / QmGUI4.dll / gameuirender.dll from an unexpected path immediately before touching the device.
  • Sudden termination of AV/EDR processes (e.g. MsMpEng.exe) with no corresponding user-mode OpenProcess/TerminateProcess from an elevated tool — the kill originates in the kernel.
  • A newly service-installed kernel driver signed by Fedeen Games Limited on a host that does not run Tower of Fantasy.

Constants (for hunting / signatures)

Name Value
Kill IOCTL 0x222040 = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS)
Debug-port-kill IOCTL 0x222000
Magic gate 0xFA123456 (bytes 56 34 12 FA)
ZwOpenProcess desired access 0x10000000 (GENERIC_ALL)

Sigma-style hunt (pseudocode)

selection_open:
    EventID: 1            # Sysmon ProcessAccess / FileCreate on device
    TargetObject|contains: "HtAntiCheatDriver"
selection_driver:
    ImageLoaded|endswith: "GameDriverX64.sys"
    Signature: "Fedeen Games Limited"
condition: selection_open or selection_driver

See cve-2025-61155.yar for the YARA ruleset.