1_1005.sys
- Driver Name
1_1005.sys- MD5
98cc84b9709f7a78a0595e545c64879d- SHA1
d0ab09ce568aa36599dc1f6ded6bfefdf4423421- SHA256
372c21bdf8fc7bd6bda528c53fad06ef1fe8d7a549a227a87f5173027c4041f1- Imphash
ae14168e71151f57d9acc21992fb9812- Vhash
016096551d55761656651iz62xz- Authentihash
199cd79737638b15ce55681634fd0fec85137c692a1be4c45691ce63f5a9f17b- Rich PE header hash
959288c211a5f0aa151f03bc25b48c83- SSDEEP
49152:WS/FPNgMTo/a8xArdvSCCLzIg4sp1je41MKbViK2SH:WStlgMTFZ6xIueKRN- TLSH
T17C856B5AD31762E8CC71C47052237516F2707E0983EC5FF7A3D29BB0BB927A096A9748- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-02-06 08:16- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
40/70- Compilation time
2021-02-05- PDB path
E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb- Country submitter
- France
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.