3e6a14230ddc3ccf2dddc4acabe8c10ac45c12335eedace694fb670936d58082.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-02-22 03:36 VT 35/73

Driver Name: 3e6a14230ddc3ccf2dddc4acabe8c10ac45c12335eedace694fb670936d58082.sys
MD5: 21a4c48248d29c48b8edbcbfe2704571
SHA1: 3e972f7cd20f44de938cb7974d9034ffeb1911bc
SHA256: 3e6a14230ddc3ccf2dddc4acabe8c10ac45c12335eedace694fb670936d58082
Imphash: c8bf7acf6497b76ad58721e796f9a882
Vhash: 015076655d655616551iz55xz
Authentihash: 0834c68b545d2e40e93a29d7bf71e2bf63eb3c1c8b647ccfb01be36d9f5e7daa
Rich PE header hash: 60d68ccf8f859bb3239ac7db34c3506a
SSDEEP: 3072:Av2CUOSxYFZ/eKTzB0IizjQOMbJ/oMMOvOpqqRXqZ1:AvKOSUZzzWYOsJQMMO2pqqRX
TLSH: T175042801F35382E4DD6785B4CA4A600BD2707D05A33D8FAACF92BAB45F33B81E569257
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-02-22 03:36
SpcSpOpusInfo: 海南企凡科技有限公司
VT detections: 35/73
Compilation time: 2023-02-17
PDB path: D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb
Country submitter: China, Hong Kong, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.