9a8323bc7187441a0d85b9a2e8f580e3.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-11 14:47 VT 43/71

Driver Name: 9a8323bc7187441a0d85b9a2e8f580e3.virus
MD5: 9a8323bc7187441a0d85b9a2e8f580e3
SHA1: f3bcd8580db05593f70fb010bfca4dc40683f776
SHA256: 40760d5a45f7978676a1eb23f379e1f06a9b57efbd439ac38ebf69e81707b718
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: dc2017a028a6caab8f81c7e5ec3491f344730b414ae85049c2341c9ee6ed157c
Rich PE header hash: 8c4317d2b0a85d863c5a1a44385242b6
SSDEEP: 24576:b6ClYurUN3BRX2xCuMb0YFgvy8eGEbIWAIYYOAeW6ofXkywHgVxHEvQrY8PPM4gq:bXYEKmCBb0YFmyeEbp6EhwaxkvIY8Pgq
TLSH: T16C55BFA972403398C41BC5785833E94AF2B5661F03E89AEBF7CB3A803B5B5D0D565F06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-11 14:47
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 43/71
Compilation time: 2022-06-11
PDB path: F:\socket版\重定向 -2022-06-9 线上 - 副本 (2)\x64\Win7Release\Projector_device.pdb
Country submitter: China, United States, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.