Driverkiller Loader And Virit Driver
Detects the DriverKiller BYOVD loader and its embedded vulnerable TG Soft VirIT Agent driver (CVE-2017-17472) by requiring the leftover PDB path artifact together with a known SHA-256 hash match, rather than either indicator alone, to avoid matching legitimate VirIT Agent installations or unrelated files containing only a subset of the indicators
YARA
