1.sys
- Driver Name
1.sys- MD5
1693441ce2f034404d1e6aa5a2c4ba7f- SHA1
123da03661d165e14cd28e6379c9421062a06413- SHA256
176f32495298619ac26ed52a7554f5b4c85c72a29363c5b89df678ad438e9b94- Imphash
ae14168e71151f57d9acc21992fb9812- Vhash
016096551d55761656651iz62xz- Authentihash
617b5b4bcb3817063966ca40235d2aff38e912b217abf5807793ac90936c33d1- Rich PE header hash
444289698dc0195c99d0e3905b94e916- SSDEEP
49152:hqZsr4/zKHi3Nwq1+sj8d690+FopAGz8xadSC:hqu4/zv3L1j4+4cAZ- TLSH
T1C4956C6AD31B62A8CC75C8B056277516F1703E0983BC1FFBE3C29BB06B877909569748- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-02-28 13:17- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
41/74- Compilation time
2021-02-25- PDB path
E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb- Country submitter
- France
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz