2ff65eaca2ace4d13d0c7db521120e51.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-05-15 08:25 VT 37/71

Driver Name: 2ff65eaca2ace4d13d0c7db521120e51.bin
MD5: 2ff65eaca2ace4d13d0c7db521120e51
SHA1: a9c16b188132cdf9e9d02ddda7727a241dc43ce2
SHA256: 04a269dd0a03e32e5b2a1c8ab0768791962e040d080d44dc44dab01dd7954f2b
Imphash: 40758fe0a03b654da35a5f035d0343c5
Vhash: 034066551d1516151iz15xz
Authentihash: 221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9
Rich PE header hash: 4515084119c0d55b8843fcbe64611276
SSDEEP: 384:+drYrE2xA75P5hD4zPxSDKjSf2TrPFRsZ2ZnR1lei:+XiHjSevbJfb
TLSH: T119D26CD2166C00C3E96758B8C3A4D787BDB9B786170255CF0761D2A51FB3BC6AB38924
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-05-15 08:25
SpcSpOpusInfo: Globalsign 中国
VT detections: 37/71
Compilation time: 2021-05-15
PDB path: G:\源码\hello\x64\Release\netfilterdrv.pdb
Country submitter: China
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u