Projector_device.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-28 10:17 VT 36/70

Driver Name: Projector_device.sys
MD5: 27bb03f2659cd95bf9e7af899ee32728
SHA1: e12c44865a56a7085097d028bccd22608ed6214f
SHA256: 10cf63dce9ea260f48def203313edcec06a293db3e35589954a99582c0a7e1d2
Imphash: f1ddca64337ececbc9ed9f5e467efba1
Vhash: 016096555d15761656651iz59xz
Authentihash: 10a31f18d86caa79a0ef8df28d422918de5a0cd903331a80598cedb335c0e8bc
Rich PE header hash: cb2c010baaa4877dc84312faf1a4058f
SSDEEP: 24576:Gyb3cbVoKV8bW2sZ7s7yPO4w+si4m3ylb6Sj1Uk1Nw2Ybte:GybkoKibWls7yW0zXVgP+te
TLSH: T18F55BEAED35263ACCC1AC83894237905F2B06D0A47FC5FABB2D7B7E06B5B520E155706
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-28 10:17
SpcSpOpusInfo: 沈阳捷优网络科技有限公司
VT detections: 36/70
Compilation time: 2022-03-28
PDB path: D:\huanhu\投影仪\KB_VRX_deviced\x64\Win7Release\Projector_device.pdb
Country submitter: Turkey, PE, TN, China, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.