e9a786a47d0b8df1fdfe691e609cb78e.virus
- Driver Name
e9a786a47d0b8df1fdfe691e609cb78e.virus- MD5
e9a786a47d0b8df1fdfe691e609cb78e- SHA1
4c471e10a0926ebc1868b0dbc739c9137955f529- SHA256
1f343d83355bc8c42bbeecdfb8f8ed38cd3b3cc0826beafa84ed660c6813864d- Imphash
633c885f57ccee60fa69445dea1892b7- Vhash
016086555d55761656651iz57xz- Authentihash
8c0dce941797068096a56189a137191a40d5c7d69307438f44baf613c3b5e33c- Rich PE header hash
7a636910d32765bace1b0b2740e20351- SSDEEP
24576:hdkRe/OG9poTqLpbIciol3jXe2t451CiDOOckJr1dMdRcjrhu56n7vAmH9gh:aeGApOq2El3jXX+dDnck7M56rAmHW- TLSH
T138856C65E3131298CC76C4B4953A7D26A4312D2983FD1FF6F399ABB0A71E1D0A279F04- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-06-15 03:45- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
42/73- Compilation time
2021-06-15- PDB path
E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb- Country submitter
- Canada
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz