Fsfilter2.sys
- Driver Name
Fsfilter2.sys- MD5
e5f62ef06b0dd656e1e47913f01f9f8a- SHA1
7afc3da9514a6ab22a36bbd7272627391e5680b0- SHA256
315854ec602d0a9cd570189e1133482d510661979ebe4833b1420c764da4f591- Imphash
741aaf38fd135aaba1b3d14913f7a0f8- Vhash
0360b6050d050606060d19z17z1xz- Authentihash
95bcc6e5ec24ec43102fc568ba01b7aaa295cda3247a26b520e64bf41d614d66- Rich PE header hash
N/A- SSDEEP
49152:nPyl8Uc1o8ckY/A3ZWWbSNBr6G7Ck//jus1bg+TabLORYLN4IfPn5PLl+j:al1c1oBkfZLeNh6lk//ju0ILEYT5E- TLSH
T10BE502FD6198335CC41EC9709437BD89F2B5421E46E894BAB7EB3AC07B57460E902F4A- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2020-12-01 08:40- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
34/70- Compilation time
2020-11-30- PDB path
N/A- Country submitter
- United Kingdom, France
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.
Indicators of Compromise:
C2 IPs: 45.248.8[.]212, 103.88.32[.]122, 103.85.86[.]3, 103.60.165[.]145, 110.42.9[.]59, 27.124.40[.]169
C2 ports: TCP 2025, 2136, 2247, 2389, 2467, 2598, 2673, 2781, 2859, 2962
C2 paths: /api/system/getSystemInfo, /api/safe/downfilelist, /driverfile/
Proxy URLs: hxxp://hxtai.mirpac[.]com/api/pac/pacReback.html?key=10073, hxxp://moren.mirpac[.]com/t.txt
Device: \Device\MyDevice264 (symlink MyDriver264)
Marker files: c:\juling.console, c:\config.pac