0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a - Copy.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-05-23 08:37 VT 42/73

Driver Name: 0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a - Copy.sys
MD5: 3452586b669e12c1c4ee9db3c1006018
SHA1: 7012080f641fad4df020f1d3e3bc47105c1bce26
SHA256: 0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a
Imphash: 0af94e6bdf1b9c0c8e243d11cf96cb97
Vhash: 016086655d15761656651iz5dxz
Authentihash: 8abf744f0cbf09d67afc5b7cc9d613e69c73a5c8a45bcd26cf6bcfd03c3515ac
Rich PE header hash: 287d125607c7510cb5799978925976e8
SSDEEP: 24576:tzK0xY5DNKcRDze8ySFRtrzwvxrpXncKucN7OSp5zEjyiwZ8Bgoqm1SlOrk:tzKWM5KcpznySxXaF3NX7Lp5zEOiwYRc
TLSH: T11455BE5D7294331CC41EC1748433BD0AF2B5661F0BE58AEB73DBAAC03B669A4E552B07
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-05-23 08:37
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-05-21
PDB path: D:\投影仪\ProjectorSys\x64\Win7Release\Projector_device.pdb
Country submitter: Philippines, United States, FI, Netherlands, China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.