60e2ca11ede0fe8b8d49d10755a1e31e.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-11 14:47 VT 42/73

Driver Name: 60e2ca11ede0fe8b8d49d10755a1e31e.virus
MD5: 60e2ca11ede0fe8b8d49d10755a1e31e
SHA1: ec528af4dfd9adf560310fc557a3263a0f890151
SHA256: 0992b8ce7db5ace64120201692bbf4ee89f0a168a9970bfe923023bf0baf088e
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: f577ec0a5bf746302ef6d32969079b33cd4de0f7cbb26edaca8707d45cc31bd6
Rich PE header hash: 8c4317d2b0a85d863c5a1a44385242b6
SSDEEP: 24576:I6ZqJPrkJ/TyqS+NPf7Gc2DwpnULM33FoHaaIhLR0VA3wW6oMrW/nmsYJ+t8VTOY:InJPrkU+BKc2DwpnULo3FoHaaULR0VGi
TLSH: T16A55BFAA7144332CD41BC5349923794AF172A50A0FA88AFFB2D776D03BAF5D4E525F02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-11 14:47
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-06-11
PDB path: F:\socket版\重定向 -2022-06-9 线上 - 副本 (2)\x64\Win7Release\Projector_device.pdb
Country submitter: Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.