KB_VRX_device.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-18 08:28 VT 41/73

Driver Name: KB_VRX_device.sys
MD5: e0e0c46ba4f969919e2879717c60ef2a
SHA1: 87ec443726a8a757b5a36df9808885ca863276ee
SHA256: 34ef13001240cb5808e36c19426b1636c31e1f54ca97117a51509839b3e18a7f
Imphash: 6a4b1bcf05e6e0a2b1cdcf0be207c18e
Vhash: 016086555d15761656651iz5exz
Authentihash: 1a141dbf3d69d2bfac95c1d97d299929fc0896bf83fca022b57ec12a642c1c76
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:B1iHYk5LZcZjuLpFJPlFDkwhx/dLMB2Iikp3xWOR7UT6xh9:B1lkjGjmrhlFDbHF6/3ww7xn
TLSH: T1E9559E69D34B73E8CC2A84709127B946F1752E0D42FD8FF6B2D2EFE06B67120A50574A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-18 08:28
SpcSpOpusInfo: 厦门渝山科技有限公司
VT detections: 41/73
Compilation time: 2022-03-18
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: China, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.