Malicious driver samples submitted but not processed

[AnthonyQ 56]

Hi,

I have submitted the following two malicious driver / rootkit samples to samples[at]eset.com for analysis:

https://www.virustotal.com/gui/file/89512dc510da375ed93a2ad340de85b7db7faee1f0fe21c04189e85a140e4970

https://www.virustotal.com/gui/file/ccb8cfde53f6e66736d2b78555cc7aa443452a75e93f5f7818f673f9391d4caa

But so far I haven't received any replies, and no detection has been added. 

Have these samples been processed? Or, ESET determines these samples are not malicious?

Thanks.

[itman 1,801]

Damn!

Both drivers are using Microsoft attestation kernel mode code signed drivers. I guess its time I write a posting on the "clear and present danger" Microsoft attestation code signed drivers present in Win 10/11.

BTW - this is not the first time attestation signed drivers have been deployed maliciously.

I also strongly recommend to Eset that they at least throw a warning alert on attempted installation of attestation signed drivers.

Edited June 27, 2022 by itman

[AnthonyQ 56]

Update:

Upon checking, these samples are detected as Rootkit by ESET now.