2AD4562FA0548EF823257346560D07DBD869DD06B20C884D0D493C319D891A32.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 45/73

Driver Name: 2AD4562FA0548EF823257346560D07DBD869DD06B20C884D0D493C319D891A32.sys
MD5: 0ece14d932990344ef2f84d75f47bb5b
SHA1: d59bf08f44ebfacbe6a5ae71c996133e2a7beed4
SHA256: 2ad4562fa0548ef823257346560d07dbd869dd06b20c884d0d493c319d891a32
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: e76964ac0615def844215f229119616b0e48f492a1c278a3efcc28a821de2d7f
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:es6vJCt6ousll9J/8UUB+NqFrg3aVUOBBE37DB+hS2W7yQOre:eN27d9Wg6UO7o7UST
TLSH: T191659E5AD34373A8CC2A84349527F846F1B16E0943AC4FEBF3D3ABE06B565A0E115B47
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 45/73
Compilation time: 2022-06-30
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: China, Hong Kong
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.