Malicious
64-bit kernel driver signed by Microsoft WHQL publisher but flagged rootkit/keylogger by four tier-1 engines plus community YARA rule.
bb1b4e46f1e4a7f17b…e2656ba48bThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Engine consensus on named rootkit families from multiple high-trust vendors outweighs the clean signer. The explicit community keylogger rule and filename provide corroborating static indicators. Absence of sandbox or network malice is noted but does not override the detection pattern for a kernel component. Microsoft WHQL signing reduces but does not eliminate risk of certificate abuse or supply-chain compromise.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.topDetections[0].result=Rootkit.Agent.AJNQ (BitDefender tier1)
communityComments[0].tags contains kernel, module, keylogger, SUSP_KERNEL_MODULE_KEYLOGGER_May26
signing.trustedPublisher.matched=true (Microsoft) with verified=true
engines.tier1Malicious=4 and tier1FamilyConsensus.family=rootkit
file.fileName=keylog.sys
- Verified Microsoft WHQL signature
- Zero offensive MITRE techniques observed
- No malicious contacted hosts or dropped children
- Kernel-mode rootkit capability
- Keylogger indicators in filename and community rules
- Recent first-seen (24 days)
Treat as malicious rootkit driver; remove immediately and monitor for persistence mechanisms.
rootkit corroborated by 3 sources
- 1 YARA rulePE_Digital_Certificate
- VT (75 engines)rootkit
- MT AI EngineRootkit.Agent.AJNQ
1 corroborating signal from researcher-curated sources
- PE_Digital_Certificateby albertzsigovits
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
- PE_Digital_Certificate
11 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- keylog.sys
- Size
- 52.7 KB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- bb1b4e46f1e4a7f17b1b04ee08c33400b2b6fd2327612a4d84da81e2656ba48b
- MD5
- 78f8396b9daf27d08aeec10539eeab56
- SHA-1
- bd807ab5dfa0a716128c2167bfe12fcaa9bdb491
- PE imphash
- 3c5120e1731c07a9c5b348e9d428650b
- First seen (VT)
- 5/11/2026, 2:54:30 PM
- Last analysis (VT)
- 6/4/2026, 9:39:14 AM
- First scan (MalwareTips)
- 6/4/2026, 11:47:25 AM
- Last scan (MalwareTips)
- 6/4/2026, 11:47:25 AM
- Code signer
- Microsoft Windows Hardware Compatibility Publisherverified
- Community reputation
- -1flagged
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.