netfilter.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-17 14:36 VT 40/72

Driver Name: netfilter.sys
MD5: 916ba55fc004b85939ee0cc86a5191c5
SHA1: 8788f4b39cbf037270904bdb8118c8b037ee6562
SHA256: 115034373fc0ec8f75fb075b7a7011b603259ecc0aca271445e559b5404a1406
Imphash: e938b727f5a033818337f7ba0584500f
Vhash: 044066655d1516551iz49xz
Authentihash: 12a636449a491ef3dc8688c5d25be9ebf785874f9c4573667eefd42139201aa4
Rich PE header hash: a47d93f02dee54ad56542d814d001142
SSDEEP: 768:Ye3CIY8B94n0urUMxQYjy+NkfrxnOLII2gnjRPftrb7T6Z:H3bY87SKflns2gNHtPiZ
TLSH: T179239E95A1E808E5DEA7E5B8C2A6D607EBB074551711D7DF03B0849A0F333D0BE3A786
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-17 14:36
SpcSpOpusInfo: Globalsign 中国
VT detections: 40/72
Compilation time: 2021-03-17
PDB path: C:\Users\omen\source\repos\netfilterdrv\x64\Release\netfilterdrv.pdb
Country submitter: BD, China, United Kingdom, France
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u