2.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-02-20 02:34 VT 41/73

Driver Name: 2.sys
MD5: 3caff348730f5b65c0e70b195e2e5a7e
SHA1: 0e1f276b842e9d7bf252889e28c92580e1f605c9
SHA256: 2d4c2c621bbfbca1ad6c55d7b12e9ae90aab97df75271d8b53752638da2c6331
Imphash: 20e3283683e86ff812ac5e4c390b52d1
Vhash: 016086551d65765665151iz3axz
Authentihash: 4505406e014f9cb14ec4b386703bf5f6897c788daca3f4242da4eb608da3b309
Rich PE header hash: 5a8d67f1148a89a19aba9fba85668b53
SSDEEP: 24576:HfAP0nT/kyKj0JCXhvlB++ySgMvFECgnZubQQT1B1P1OCBPqZvcGj8ARU:Hc6s3nXhNL6iknZubpB1PYCxqN79RU
TLSH: T1AD65AE69D30762A8CC65C0B056233415F1707D4C87EC9FBBF3D3ABB0BAA66A0D559748
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-02-20 02:34
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 41/73
Compilation time: 2021-02-19
PDB path: E:\ColdProtect-2\x64\Debug\Fsfilter264.pdb
Country submitter: France
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.