N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-16 09:58 VT 38/73

Driver Name: N/A
MD5: bbdaf94b124e28435835004290fc2f57
SHA1: bc8f8665de6513bb87dade79e42bbf51be1b967a
SHA256: 2a7beb86e6f8d6afa10726bddd4f8c0fb83fc5619b0985846e8eb362d712b50b
Imphash: 4e97d36152e8092401db2cdcda243920
Vhash: 016086555d55761656651iz62xz
Authentihash: 057e046549fbc0da6af53dd3fea6b618b4a43ea1a40ce355f59b7810e1d481f6
Rich PE header hash: 76aaf95953c5083ec69cf532d964cb4f
SSDEEP: 49152:ZRvoF0UMkKI5xuBDcl6AXEI4/4WXulVbrtQ7j:ZRE0UMCYlcl6DJ4nt6
TLSH: T182955B45E3235298CC75C0F0A57A3917A5327D2983AD2FF7E385ABA0A70E5D0A27DF44
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-16 09:58
SpcSpOpusInfo: 福建奥创互娱科技有限公司
VT detections: 38/73
Compilation time: 2021-07-16
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: France
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz