I came across MuMu Player because of a youtube video I saw. It got a benign from Checkpoint Threat Emulation, but I also put it into Any.Run to see what it would do, and it was flagged as malware for vulnerable driver abuse.
Link: hxxps://www.mumuplayer.com/
VT:
VirusTotal
Any.Run:
Analysis MuMu_6.0.1_SCdhCzC.exe (MD5: 825F811C7541D19F8C13901DD1D5E7A2) Malicious activity - Interactive analysis ANY.RUN
I'm not sure how emulators work, but bringing a Kernel Level Driver seems extremely suspicious. Could someone take a look?
What the detections show
A kernel-mode driver is not automatically evidence that MuMu Player is malware. Android emulators commonly install privileged components for functions such as:
- Hardware-assisted virtualization and CPU access
- Graphics, input, networking, or device emulation
- File and clipboard integration between Android and Windows
- Installing or managing the emulator’s virtual device
However, a driver being legitimate does not make it risk-free. A driver with excessive privileges, known vulnerabilities, weak signing, or an unrestricted IOCTL interface can potentially be abused by other software.
Interpreting the Any.Run result
The “vulnerable driver abuse” classification may mean that the analysis observed a driver with characteristics associated with BYOVD activity. It does not, by itself, prove that MuMu Player was exploiting the driver maliciously. Sandboxes also frequently classify legitimate virtualization, anti-cheat, system-management, and emulator drivers as suspicious because their behavior resembles techniques used by malware.
The important details are:
- The exact driver filename and SHA-256 hash
- The driver’s digital-signature publisher and certificate chain
- Whether the driver has a documented CVE or appears on Microsoft’s vulnerable-driver blocklist
- Which process installed or loaded it
- The device objects and IOCTL operations it exposes
- Whether the installer downloads additional components from unexpected domains
The Any.Run task should therefore be examined for the specific driver name, hash, signer, and observed actions rather than relying only on its overall “malicious activity” label.
About the VirusTotal result
A low-detection or clean result is useful but not conclusive. It can indicate that the submitted file is not broadly detected as malware, while still leaving questions about:
- The reputation and authenticity of the download source
- Potentially unwanted software or bundled components
- The security of an installed kernel driver
- Whether the sample is the current official version
The Check Point result is also only one analysis result. Neither a benign sandbox result nor a single suspicious sandbox classification is sufficient to establish the final verdict.
Safer verification steps
- Verify the installer’s SHA-256 hash against a value published by the vendor, if one is available.
- Check the installer and all installed driver files using Windows file properties and confirm the digital signature. Do not treat “signed” alone as proof of safety; verify the signer and certificate validity.
- Identify the installed drivers with Autoruns from Microsoft Sysinternals, Device Manager, or PowerShell. Record the driver filename, publisher, version, and hash.
- Search the exact driver hash and filename in VirusTotal, Microsoft’s vulnerable-driver documentation, and reputable security research.
- Install only from the vendor’s official site or a trusted app-distribution source, and avoid repacked installers.
- If you do not need the emulator, uninstall it and confirm that its services and drivers are removed. Reboot afterward and recheck the installed drivers.
Do not manually delete a kernel driver while it is loaded. Use the application’s uninstaller or the vendor’s documented removal procedure; manual removal can cause boot or device problems.
Based on the information provided, the Any.Run label alone does not establish that the official MuMu installer is malware. It does justify checking the exact driver involved, its signature, vulnerability status, and origin before installing it on a primary system. If those details show an unsigned driver, an unexpected publisher, a known exploitable driver, or suspicious network/download behavior, avoid the installer and submit the driver and installer for additional expert analysis.
