18f71fc3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 06:09 VT 41/72

Driver Name: 18f71fc3.sys
MD5: 2cc14f20cf6847a2084f2c9cc0622015
SHA1: ed5b8c4570decfdc41a298193b08eed239c9dd9f
SHA256: 142c6f5b7079f87e65df022f5fccfe229a0f41803c0d3eee42d38ed09eb73b86
Imphash: 467798d7c212fab82a6681f61778d791
Vhash: 016086655d15761656651iz6yz
Authentihash: 28f6baffbd5e11ccfc3f1f7f08e467bd1476872c6579b3295164d192fdac1996
Rich PE header hash: 8b68754fc2ef581f2f15b37a4d741936
SSDEEP: 24576:SiNE2qMq+5EmYYroH38/4P8LwsLtmmCtFYKau23VYOjmIzDrOQz0XSBMitxLeT7:Sig65Mkk3pUcqtmmCgKau2FYOjRnyQz4
TLSH: T14B55BFAC728033A8C46AC8349133FD05F2B5251F17B98AFBB7C676906F375A4E165B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 06:09
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 41/72
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: China, United States, Malaysia
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.