netfilter.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-28 02:56 VT 38/69

Driver Name: netfilter.sys
MD5: e3fb0f73f17f1fe04ae8fa9448d2f92b
SHA1: 4656f21f4093a72864b12ad6783a640ec9d4adff
SHA256: 40c45c9b1c764777096b59f99ae524cbd25b88c805187e615c3ed6840f3d4c15
Imphash: e938b727f5a033818337f7ba0584500f
Vhash: 044066655d1516551iz49xz
Authentihash: 7f1772bdf7dd81cb00d30159d19d4eb9160b54d7609b36f781d08ca3afbd29a7
Rich PE header hash: b324bb3bfe051a8ce6eaa984b648d37e
SSDEEP: 768:RffaDUzOX3qiu2UrWh5Y5jTaSsxSlH2gGVktHj20tftIb8y5z8:xfIUz/Ch50/sPg8kp20lte8qY
TLSH: T1E8238E55A1E854E6DAA7E578C2A69607EBF074651312CBDF03B0C45A0F333E0BE3A746
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-28 02:56
SpcSpOpusInfo: Globalsign 中国
VT detections: 38/69
Compilation time: 2021-03-27
PDB path: C:\Users\omen\source\repos\netfilterdrv\x64\Release\netfilterdrv.pdb
Country submitter: RS, Italy, United States, South Korea
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u