savitar2k.sys

Malicious Shanghai Zherui Network Technology Co., Ltd. 2021-12-07 14:17 VT 13/73

Driver Name: savitar2k.sys
MD5: dbfb2582567d22bdea8f84021ffb5313
SHA1: e4da6601cc0ffe5ae78fa94ccdfc4500d37a2e23
SHA256: 21fa416ef1f485d757718126c8e4101d662f82e58bade450ace79721b0b457a6
Imphash: 9a4a2e5cede0beb19eba662f7f5a1e4c
Vhash: 074066651d16551569z26z35xz
Authentihash: a2135ea9c89242d3d80b7ef4e64ac8b8e488b888b6e4adac96be11c8281f465a
Rich PE header hash: 50e4a382f117bcf889fb64d10031280a
SSDEEP: 1536:Jmo5DCLD18HOi1S8b83bPf5Q+XG5nRqFW9bogAbz/xr:JmP18F118L6+XKRqFW2rR
TLSH: T1E9637ED3D6000C73D6C64971B2E8E3176B39DF060A9450FB8B2489D45671BD1EAAD36F
Signer: Shanghai Zherui Network Technology Co., Ltd.
Signing date: 2021-12-07 14:17
SpcSpOpusInfo: kuaigun; 南京偲言睿网络科技有限公司
VT detections: 13/73
Compilation time: 2021-10-10
PDB path: E:\Project\SmallProject\netfilter\netfilter\build\bin\Win32\Win8_Release\tdi.pdb
Country submitter: United States
Flag: Malicious

Description

A kernel-mode TDI filter that attaches above \Device\Tcp, \Device\Tcp6, \Device\Udp, and \Device\Udp6 via IoAttachDeviceToDeviceStack, intercepting every TCP/UDP IRP on the host and forwarding them; configured through a single IOCTL (0x220364) on \Device\Ctrl.