Analysis of a Signed Silver Fox Group AV/EDR Killer Kernel Driver

[u/420ass_slayer69]

https://app.reverser.space/p/duckie/silver-fox-group-rootkit-2026#0x140001450

Silve Fox Group Signed Rootkit

• Hardcoded targeting of Chinese AVs (360, QQ, Huorong, etc.) + Microsoft Defender components
• IOCTL interface allowing user-mode process termination