viragt.sys

viragt.sys (and the 64-bit viragt64.sysDriverviragt64.sysVirIT antivirus agent driver (64-bit)Open plate →) is the kernel driver from TG Soft's VirIT antivirus engine. It is on the public LOLDrivers list because its IOCTL surface allows a caller to terminate processes from kernel mode without adequate access checks. It is the same capability the antivirus uses to stop hostile software, exposed too permissively to lower-privileged callers.

On the public record: security researchers (Trend Micro and others) have documented data-extortion crews loading older signed copies of viragt64.sys onto systems they had already compromised, then using it to terminate hundreds of security and system-utility processes by name before encrypting files. The pattern is the recurring BYOVD theme: an antivirus driver weaponized to disable antivirus.

Typically present on systems running VirIT products. The driver's presence on a machine that has never run VirIT is worth a closer look.

viragt.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 7 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.