kcldtukt587G.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-08 18:29 VT 38/73

Driver Name: kcldtukt587G.sys
MD5: 395ea8b7d0f257850a3a04a1484bac4d
SHA1: aadfae7c3bf9f4f35409a58b53f8f17a72e5c295
SHA256: 4690088fda26d32a5a9576012294b38aba45521a39a146e04009e487a4df8eb1
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: 1d50617d219b08534d565e3cca3b6edc29802048023f5fb0c7652ae1c8934f14
Rich PE header hash: 8c4317d2b0a85d863c5a1a44385242b6
SSDEEP: 24576:TR5qVh3UE284CJXTMfqvduh+WQSQpggTA9eBznTq6fUsoPGluo06XXGFzBWRQ4gG:TRy9UynJXT6hJgKepn+6f+GlhPXXAwRJ
TLSH: T12D55BFA87288335CC85AC4748037A949F175730E47B9C6FBB3EB7A907BB70A0D525E49
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-08 18:29
SpcSpOpusInfo: 厦门沁云网络科技有限公司
VT detections: 38/73
Compilation time: 2022-06-08
PDB path: F:\socket版\重定向 -2022-06-4 线上\x64\Win7Release\Projector_device.pdb
Country submitter: Italy, China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.