File verdict·Decided by the MT AI Engine
Our call

Malicious

64-bit kernel driver signed by Microsoft WHQL publisher but flagged rootkit/keylogger by four tier-1 engines plus community YARA rule.

Rootkit.Agent.AJNQVerified · Microsoft Windows Hardware Compatibility Publ…
Trust score12Critical
MT AI confidence · 78%
keylog.sys
52.7 KB
bb1b4e46f1e4a7f17be2656ba48b
Antivirus engines
11 of 75 flagged
Code signing
Signed by Microsoft Windows Hardware Compatibility Publ…
Age
First seen 1mo ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

78%Confidence
High
Reasoning

Engine consensus on named rootkit families from multiple high-trust vendors outweighs the clean signer. The explicit community keylogger rule and filename provide corroborating static indicators. Absence of sandbox or network malice is noted but does not override the detection pattern for a kernel component. Microsoft WHQL signing reduces but does not eliminate risk of certificate abuse or supply-chain compromise.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.topDetections[0].result=Rootkit.Agent.AJNQ (BitDefender tier1)

  2. communityComments[0].tags contains kernel, module, keylogger, SUSP_KERNEL_MODULE_KEYLOGGER_May26

  3. signing.trustedPublisher.matched=true (Microsoft) with verified=true

  4. engines.tier1Malicious=4 and tier1FamilyConsensus.family=rootkit

  5. file.fileName=keylog.sys

Points in its favour
  • Verified Microsoft WHQL signature
  • Zero offensive MITRE techniques observed
  • No malicious contacted hosts or dropped children
Points against
  • Kernel-mode rootkit capability
  • Keylogger indicators in filename and community rules
  • Recent first-seen (24 days)
What to do

Treat as malicious rootkit driver; remove immediately and monitor for persistence mechanisms.

Threat family attribution

rootkit corroborated by 3 sources

  • 1 YARA rule
    PE_Digital_Certificate
  • VT (75 engines)
    rootkit
  • MT AI Engine
    Rootkit.Agent.AJNQ
External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·1 community rule matchedView on YARAify
  • PE_Digital_Certificateby albertzsigovits
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 YARAify
YARAify (community)
Researcher-authored rules via abuse.ch
  • PE_Digital_Certificate
Antivirus engine breakdown

11 detections across 75 engines

11 malicious0 suspicious64 clean
Tier-117 engines
4flag
Top commercial AVs (low FP rate)
Tier-238 engines
5flag
Mainstream engines with mixed FP rates
Low-trust20 engines
2flag
Heuristic / generic-AI engines (high FP rate)
BitDefender
malicious
Rootkit.Agent.AJNQ
CTX
malicious
sys.trojan.generic
DrWeb
malicious
Trojan.NtRootKit.20678
Emsisoft
malicious
Rootkit.Agent.AJNQ (B)
ESET-NOD32
malicious
Win64/Rootkit.Agent.EU trojan
Google
malicious
Detected
McAfeeD
malicious
ti!BB1B4E46F1E4
MicroWorld-eScan
malicious
Rootkit.Agent.AJNQ
Rising
malicious
Trojan.Kryptik!1.13F9B (CLASSIC)
TrellixENS
malicious
Artemis!78F8396B9DAF
Varist
malicious
W64/ABTrojan.DNEB-4994
Hash bb1b4e46f1e4… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 7.49Unpacked
Section entropy6 sections
.text
6.24
.rdata
4.08
.data
0.14
.pdata
3.31
INIT
0.83
.reloc
0.54
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
10
Moderate upload volume.
Total submissions
13
Includes repeat uploads by the same source.
First seen by VT
1mo ago
May 11, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/11/2026, 2:54:30 PM
First seen (MalwareBazaar)
Last analysis (VT)
6/4/2026, 9:39:14 AM
Scanned here
6/4/2026, 11:47:25 AM
File name
keylog.sys
Size
52.7 KB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
bb1b4e46f1e4a7f17b1b04ee08c33400b2b6fd2327612a4d84da81e2656ba48b
MD5
78f8396b9daf27d08aeec10539eeab56
SHA-1
bd807ab5dfa0a716128c2167bfe12fcaa9bdb491
PE imphash
3c5120e1731c07a9c5b348e9d428650b
First seen (VT)
5/11/2026, 2:54:30 PM
Last analysis (VT)
6/4/2026, 9:39:14 AM
First scan (MalwareTips)
6/4/2026, 11:47:25 AM
Last scan (MalwareTips)
6/4/2026, 11:47:25 AM
Code signer
Microsoft Windows Hardware Compatibility Publisherverified
Community reputation
-1flagged
Behavior tags
64bitsnativeoverlaysignedpeexe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.