ntbios.sys

Daxin rootkit -- NDIS variant

From Unknown state-sponsored threat actor

Part of the Daxin family

Status

On a known malicious list

Known variants

1 distinct hashes

Field notes

ntbios.sys is a variant of Daxin, the sophisticated state-sponsored rootkit backdoor disclosed by Symantec (Broadcom) and CISA in February 2022. The filename mimics the legitimate Windows netbios.sys networking driver. Like all Daxin variants, it hooks the NDIS (Network Driver Interface Specification) layer at the TCP/IP protocol level to intercept traffic for covert command-and-control communication.

See the daxin_blank.sys entry for the full story. Not a legitimate vendor driver. Presence indicates a targeted intrusion.

What the record shows

ntbios.sys is listed as malicious on the public LOLDrivers project. One distinct binary hash matching this filename is on record.

What this means, plainly

Presence is not proof of misuse. This filename matches a public malicious list. Vera notes it as evidence on a record; the meaning still belongs to the people with the context.

Related drivers

Other drivers in the Daxin family. See the whole family →

daxin_blank.sys daxin_blank1.sys daxin_blank2.sys daxin_blank3.sys daxin_blank4.sys daxin_blank5.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “ntbios.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/ntbios-sys