41EDCD8F61CC53498B63364921CE18905126E8F6C2961D5CD4D18656C5E36539.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 45/73

Driver Name: 41EDCD8F61CC53498B63364921CE18905126E8F6C2961D5CD4D18656C5E36539.sys
MD5: 8986b5b6013cfb2bd3e6c8d22c453390
SHA1: 90819eb4cc2f2034347ed0d8c21af5d63e8acc24
SHA256: 41edcd8f61cc53498b63364921ce18905126e8f6c2961d5cd4d18656c5e36539
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 44f612bc7562cf09254199b6b59f44f9398781b7b9b3d017d684331b920cae8a
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:Tl3S3wANSrqSbTzfDuNJ5g9L/U8TJfhHXWUE3iu9DGP2Ox95zyUe86S:Tl3Q7Srq0socMfxWAu5GuO1yVxS
TLSH: T18765AFA9D34663ACCC1A88708037B805F1B42E4D47EC8FF7B7D7FBA07B669909165609
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 45/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: China, NO
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.