2303b69f630d35d7eae22d30c5efeb76d6d89e80c7be9365b90db44e5ce5e94a.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-19 07:43 VT 50/73

Driver Name: 2303b69f630d35d7eae22d30c5efeb76d6d89e80c7be9365b90db44e5ce5e94a.sys
MD5: e2c146a2522e4f40e5036c3fe12c3560
SHA1: a51034c542716be361bd81642e589d814fcd237e
SHA256: 2303b69f630d35d7eae22d30c5efeb76d6d89e80c7be9365b90db44e5ce5e94a
Imphash: 4e97d36152e8092401db2cdcda243920
Vhash: 016086555d55761656651iz62xz
Authentihash: 3a35ac2b7537d7c5239735813ca8bd9854fe771e41c18f754489db50cde7ebf6
Rich PE header hash: 76aaf95953c5083ec69cf532d964cb4f
SSDEEP: 49152:C84VT+ssMKbpbgNEAYWQmZBwp27tJ+xUuRY:C8iTAyzY3nutIyKY
TLSH: T160955A55E3135298CC79C0B0A57E3912A5717D2883ED1FF6E385AFA0A74E5D0A23EF48
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-19 07:43
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 50/73
Compilation time: 2021-07-19
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: Turkey, United States, Philippines, France, China, NO
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz