C2962215B2EB.dat

Malicious 迷南文化传媒（上海）有限公司 2021-09-09 15:31 VT 43/73

Driver Name: C2962215B2EB.dat
MD5: 6e8074960d6d8e0bb5e0e97e066dc529
SHA1: c95e951926c1dbf0c1983145dc4492016cfeefeb
SHA256: 0b887a7c8e3fc48f66df1e59f842857349a97f99258756e782c526535d193e9e
Imphash: 5db957e86e21991d28846f3f127cb562
Vhash: 026096050d0506060d1779z17z1xz
Authentihash: 9d8cac1f8e4233c47913f0e310aa89753631a4b7870f6c33905e9b754d9c17e8
Rich PE header hash: N/A
SSDEEP: 49152:CJfvBkcLEDiD46+5AZJfdg2dg+JRFh9IOb/nvPfFwUywSdgzFCCrXh8pottiq6ys:CJHBkcoDfAZ7g2dZJV7v3FtV18pKivys
TLSH: T116D5F1ED2294375CC41AC4789433EA45F2B6511E0FF9E6B9B2DFBAD03B9A821E541F10
Signer: 迷南文化传媒（上海）有限公司
Signing date: 2021-09-09 15:31
SpcSpOpusInfo: N/A
VT detections: 43/73
Compilation time: 2021-09-09
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

FK_Undead is a kernel-level (Ring 0) Windows rootkit family that intercepts and manipulates network traffic. It routes all browser traffic through attacker-controlled proxies via PAC, blocks antivirus sites, injects code into web pages, and installs its own certificates to intercept HTTPS. It also blocks rival malware by refusing drivers with certain signatures.

IOC: 47.98.198.179