fzbt9sp0.exe
- Driver Name
fzbt9sp0.exe- MD5
d2ed678542a5d1db494dc47359861467- SHA1
38f364805ca0f4cb8d07942bf62e5e79d51f07df- SHA256
0378949d3fe9d6f0d965267cfcb68f5ac20404ddb496289f62367601026c47c2- Imphash
ae14168e71151f57d9acc21992fb9812- Vhash
016096551d55761656651iz62xz- Authentihash
1601f6f3b03525d7152a1c38aaf80a6800a47775fb938a66b1ead3ef5fb71818- Rich PE header hash
444289698dc0195c99d0e3905b94e916- SSDEEP
49152:f4twuu34ZSka1dbeWn0u4Ow2O2OORAOI8J2rC7:f4Lu3Xka2WHaw- TLSH
T1BC957C1AD31BA2E8CC75C4B056237456F1707E0983BC5FFBA3D29BB07B4679091AA748- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-03-19 13:05- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
42/74- Compilation time
2021-03-19- PDB path
E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb- Country submitter
- France, United States
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.