Fsfilter2.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-01-06 02:27 VT 39/72

Driver Name: Fsfilter2.sys
MD5: 94ca1c2ae4e9b0973e1ae6e4b0fb212f
SHA1: b860e6f08530604bcdcf3453d9b578c3b5b2b26c
SHA256: 021688ed3ba5966a1ea9ad8e186bc1a073fd73a8148f36a734624a7aece801aa
Imphash: ab7801caf39f7703a52354de80bb983f
Vhash: 016096555d55761656651iz66xz
Authentihash: 56ec2e60d0e50d46cc5ab24d57911b33e73792a81a7125c2e7173ed660df8e4b
Rich PE header hash: be0bb9f89ea53793d8cdee9cc42ae2a7
SSDEEP: 24576:h4KbniBkyp2R1/MIMn8gDJYqOiydieirph4PbwHU6eQ98l:tvpRxRMLF5OiydiD4PMHUbQCl
TLSH: T11265AF59A25833DCC43AC0748023F94BF271361F43E49AE7A3DA7A513BA36E4D939B45
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-01-06 02:27
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 39/72
Compilation time: 2021-01-05
PDB path: E:\ColdProtect\x64\Debug\Fsfilter264.pdb
Country submitter: N/A
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.