82c4b0ad.sys
- Driver Name
82c4b0ad.sys- MD5
e9ca5ad4233d52997b93df7e86f16b6d- SHA1
ce7ef83541bab60e3f85e897cca7e78d9db60179- SHA256
109699bc500301a194e9775913f632113eba5805b9b29a558bbcadced170b6e1- Imphash
e9bf2079cacb9f83f9f1babb5baa9b43- Vhash
016096551d65761656651iz4cxz- Authentihash
5beee731101a20ff7140bcd65e8cff8ab7a7ac961c1a52c8e014c054c68d6b7c- Rich PE header hash
11a1a09d106315db1dfafb60ef2a5f1d- SSDEEP
24576:fAkyMSnr6WsO8eVoPnfWkqZBVnm2n2P7a1/jSMQ8tswgzhai:fLvSnr6W5VUfWkqbxB2Ps7SBg9glai- TLSH
T1C355AEED625433ACC46EC834C023BD59B2B1311E47BA86EB75D7B6D02F536B0E925B42- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-01-15 01:15- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
44/73- Compilation time
2021-01-14- PDB path
E:\ColdProtect-2\x64\Debug\Fsfilter264.pdb- Country submitter
- United States
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.