N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-25 18:16 VT 30/73

Driver Name: N/A
MD5: ee75a9f2e052de0640143991db3a74da
SHA1: b4536fe96777e10061d6600b84ed321fbf717dd1
SHA256: 39c1f5adeb3607be9bba55b46bc3041cdef6ce7a5612d4397d1c65818610327c
Imphash: 89a96bf002d66bb66fdc4905a78578a2
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 1f0b690225c08bb2e6a2bb5fcb336cc17adf779f986a36e085a9ae4cebffe8c5
Rich PE header hash: N/A
SSDEEP: 49152:tjQzQPcI299d2vNWXa224pigUSEQoIh7HNVNtJkQtBl8CFb/QrNLFqyEgebteFOV:OkPcRrdgNVdbS3bxHTNta+8Qr2FsIONj
TLSH: T1F0F502AD5148335CC02FC5B09123FD49B2F6560E0FE996BA71E7BAC077DE854EA02B52
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-25 18:16
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 30/73
Compilation time: 2022-12-25
PDB path: N/A
Country submitter: United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.