4bf2acb6f306039be1e28373ba54ec58.virus
- Driver Name
4bf2acb6f306039be1e28373ba54ec58.virus- MD5
4bf2acb6f306039be1e28373ba54ec58- SHA1
4c5bc369193151311df4fd5ec5d33e919d266080- SHA256
15c7277fc30eeb377f1d93b47a113e1f4c0880c188144594d5ad563c3faded69- Imphash
633c885f57ccee60fa69445dea1892b7- Vhash
016086555d55761656651iz57xz- Authentihash
87768e692cfec1df7f03ae9e0fa305c6ced478fd222b56af97e792e528d6c356- Rich PE header hash
7a636910d32765bace1b0b2740e20351- SSDEEP
49152:YePTpOq+YedUe5leDsu+BlpQfOXUgmRrxxg:YU8OegoIbG- TLSH
T12F856D69E3135294CC75C4B0A53A7912B5317D2983EC0FF7A3CABFA0A71A5D4A279F04- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-06-15 03:45- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
39/73- Compilation time
2021-06-15- PDB path
E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb- Country submitter
- Canada
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz