222f58881bf80d41c672bcce73e3ada1670902d5e89a4d12daa6869aa71f89d2.exe

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-02-22 03:36 VT 33/72

Driver Name: 222f58881bf80d41c672bcce73e3ada1670902d5e89a4d12daa6869aa71f89d2.exe
MD5: 0a1452b34a7bb55777a33d310541c934
SHA1: 3eff8b10f14e7bf9c899b125e22ef104e82bbc01
SHA256: 222f58881bf80d41c672bcce73e3ada1670902d5e89a4d12daa6869aa71f89d2
Imphash: c8bf7acf6497b76ad58721e796f9a882
Vhash: 015076655d655616551iz55xz
Authentihash: 6648c04ff06890d91e21562628557e38b54ec1f40c3bfe3ed5a1a03d3f4ccbdf
Rich PE header hash: 60d68ccf8f859bb3239ac7db34c3506a
SSDEEP: 3072:Lv2CUOSxYFZ/eKTzB0IizjQO+bJ/oMMOvOpqqR/ko:LvKOSUZzzWYOSJQMMO2pqqR/x
TLSH: T15D042901F39382E4DD6785B4CA4A601BD2707C05A33D9FAACF92BA705F33B81E569257
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-02-22 03:36
SpcSpOpusInfo: 海南企凡科技有限公司
VT detections: 33/72
Compilation time: 2023-02-17
PDB path: D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb
Country submitter: China, Taiwan, United States, France
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.