9258e3cb20e24a93d4afdee9f5a0299c.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-18 11:56 VT 40/72

Driver Name: 9258e3cb20e24a93d4afdee9f5a0299c.bin
MD5: 9258e3cb20e24a93d4afdee9f5a0299c
SHA1: 0cca79962d9af574169f5dec12b1f4ca8e5e1868
SHA256: 1aa8ba45f9524847e2a36c0dc6fd80162923e88dc1be217dde2fb5894c65ff43
Imphash: eac62dd0c27ed557fa4b641fa4050d04
Vhash: 024066551d1516151iz1yz
Authentihash: 455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b
Rich PE header hash: 260f7e40bc974c643148b68fb181b0a0
SSDEEP: 384:GSkXntBr2ojp2rYxSDKb2arPFRVZyzlk:GSkjEkb2+bO
TLSH: T1D9C26BD22B3C00C3D97368B483E4E587BCBE7786075185CF0661E6A51EA3FC8AB34625
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-18 11:56
SpcSpOpusInfo: Globalsign 中国
VT detections: 40/72
Compilation time: 2021-04-18
PDB path: C:\Users\omen\Desktop\新建文件夹 (4)\x64\Release\netfilterdrv.pdb
Country submitter: France, China
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u