vpn.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-02-18 06:58 VT 43/73

Driver Name: vpn.sys
MD5: f8ccabcbe08bbd2c8420f4d1cffcefd8
SHA1: 11159e26f0ce20a574f59be928d8f459086da9a6
SHA256: 1b9d5a89cc34ae4831f0525ac3c504ff3eb1b884650a431ee488dc6572bcd126
Imphash: c4110de9fddcb44c9133bf3e705b09c7
Vhash: 016096555d15766656651iz7cxz
Authentihash: 2c7d7d7c96b43a2517ff8e31be3f6b3a873fe08b546f7deb12ea21141997a75e
Rich PE header hash: 2727c7cde3e2a5cb12fb6e08c10ff5f2
SSDEEP: 24576:JNfF6QybdIjU62lJjq6+YCC/E5+qaHy7i74V5gIdFbh4MUHVdBso3kfJAbP:JNffyKjU5INC/E5ZeqBdf+yo3oAL
TLSH: T1BC55BEA9E3527264CC1688345137B906F2B16D0E4BECCFBFB7C76B907B22560E159B09
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-02-18 06:58
SpcSpOpusInfo: 厦门恒信卓越网络科技有限公司
VT detections: 43/73
Compilation time: 2022-02-14
PDB path: D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb
Country submitter: Hong Kong
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.