vpn.sys
- Driver Name
vpn.sys- MD5
8e4d0f679b092296a2f74cf812907d05- SHA1
e706e6747e1e7de272b3804e79841a67f6b8213a- SHA256
0b40dd06a877698851e6dc4bffb55738da6ae334cf0bb36c7a2d96ac8e87aafc- Imphash
c4110de9fddcb44c9133bf3e705b09c7- Vhash
016096555d15766656651iz7cxz- Authentihash
f03d1469cedf4b0cd878998fdbcd54cfc53830e1003ad2aecbbfa2f56d738adc- Rich PE header hash
2727c7cde3e2a5cb12fb6e08c10ff5f2- SSDEEP
24576:cNfFHQyb/SvNle1gEQzsUisxJQSpdwVHXGDhnbeFrfVSSVkWfjE0:cNfOyWvreeDsvs7vEWDMpV3V9rE0- TLSH
T1B555ADB9D347739CCC2A88709127F946F1B02E0E47AC4FBAF6D6BB907B934609519B05- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2022-02-18 06:58- SpcSpOpusInfo
厦门恒信卓越网络科技有限公司- VT detections
42/73- Compilation time
2022-02-14- PDB path
D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb- Country submitter
- France, Netherlands, China
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.