0da8c855bfc5342161f2dd26946a300b.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-01-12 06:38 VT 36/71

Driver Name: 0da8c855bfc5342161f2dd26946a300b.virus
MD5: 0da8c855bfc5342161f2dd26946a300b
SHA1: 710d2862ba89a8c96ca3d32e901bd9c070bed9f7
SHA256: 24c95c025c304e1116feab40dd5daeb94aeab9d2a311018c8c41fec1789bc8fe
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 648ee8d76e9934d6c31b5b963172584ba9da14078a9b93dd93dae6f165e15bb6
Rich PE header hash: N/A
SSDEEP: 98304:vRssZeP3PVD1AGcBnBiJgWGK7Y4GXqalFH5:vPZi3P11dcBBiJmTdXbR
TLSH: T1C3F502FA22447358C42AC5705C33FE06F2B5D51D5BE4E9BAB6CB7AC07BAB811D502E06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-01-12 06:38
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 36/71
Compilation time: 2023-01-12
PDB path: N/A
Country submitter: Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.