198FC46B59CE8956C161648F9D3B31D4AC323417CB79BF77A094C0824F50DAD1.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-19 07:39 VT 43/73

Driver Name: 198FC46B59CE8956C161648F9D3B31D4AC323417CB79BF77A094C0824F50DAD1.sys
MD5: 6e3516775e7e009777dcdb7a314f1482
SHA1: 0109ac2f25d93ad06546c8c80389c4705a9160eb
SHA256: 198fc46b59ce8956c161648f9d3b31d4ac323417cb79bf77a094c0824f50dad1
Imphash: 4e97d36152e8092401db2cdcda243920
Vhash: 016086555d55761656651iz62xz
Authentihash: 5db17d88e50089a0f0a79fd35086ac1a9c702ea97a6072b16ec3ecfeeeda4990
Rich PE header hash: 76aaf95953c5083ec69cf532d964cb4f
SSDEEP: 49152:984TTZOZoM2l0Hzc/cGtSbADxbqQK12Xv:98QTmz5AtbK1ov
TLSH: T1BF955A65E3135198CC75C1B0A57A3913A5327D1883ED5FE7E389AFA0A70E2D0A27EF44
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-19 07:39
SpcSpOpusInfo: 福建奥创互娱科技有限公司
VT detections: 43/73
Compilation time: 2021-07-19
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: South Korea, United States, China, France, Germany, Italy
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz