N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-06-22 06:54 VT 42/72

Driver Name: N/A
MD5: e74e3034ca5158915f16ebeee0a47ef8
SHA1: 00b0f883cb12f5f05a8be5a48437ab373f15eb67
SHA256: 16efd94c86fc43a134fff2bfbfb83ceac87a05313d40afbb36b0bf2ee1f9e23e
Imphash: a29c052d6d153a5736168fa3994167ae
Vhash: 016086555d55761656651iz64xz
Authentihash: 487587e12e985cffcc630f99a786b7a36be04cdb90b13f2338a128657783624b
Rich PE header hash: b3fc885f5d0ef16f298ee2ff24ed3770
SSDEEP: 49152:BhlOqGpOqkfZ63gDSRC4165Hxe6cL2WDOoMJxtAnyt4p4:bcqVBM3CvRgPSoox
TLSH: T1E5856B69E3175298CC39C4B0957A3D17A5717D2883EC1FE7E386AFA0674B5D0A239F08
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-06-22 06:54
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 42/72
Compilation time: 2021-06-22
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: France
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz