← Back to malicious drivers

btanhbgo.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-30 16:51 VT 35/73

Driver Name: btanhbgo.sys
MD5: e8a907dd81f80a84cd29eab1da163f7b
SHA1: 8f3682c187cd99f232ed80f85b2a08a2771605e1
SHA256: 13ace534c70e91b09b8f48e6e0b819bdf39d2ac7e1340409faaac99077b73759
Imphash: 9fc198929de31ed420d4fa4b8883ce4e
Vhash: 035086655d151e5e6f7519z17z1xz
Authentihash: 25948c64788936b08d483ebc54401fe7f64421e7bac011183f9441b727349e01
Rich PE header hash: 929e1eea5a7860429340b9b528a3b47b
SSDEEP: 6144:YUNBkHgVVlVCKSV/FAPf0y8VR3WDrinxRxrR:YxLKSIPfuVRmDOxRb
TLSH: T1A174AED3F3C508C7E31D9E7885EA2AA17630B4B7C728DBEF550451460E696E4883C7BA
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-30 16:51
SpcSpOpusInfo: 青岛亿驰趣游网络科技有限公司
VT detections: 35/73
Compilation time: 2021-04-30
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

Kernel-mode droppers (kernel loaders). Their core function is installing a second-stage kernel driver fetched from the internet as a boot-start service: they write it to system32\drivers\.sys, create a service key with Start = 0 and Group = "System Reserved", then call ZwLoadDriver, retrying every 300 seconds on a download failure and every 180 on a load failure until it succeeds. Alongside this loader core sits a traffic-hijacking layer that rewrites the system proxy configuration and seizes the default browser handler, routing the victim’s web traffic through attacker-controlled infrastructure.

IOC: hxxp://lieyanmir.oss-cn-hangzhou.aliyuncs[.]com/cg.info