savitar2k.sys

Malicious Shanghai Zherui Network Technology Co., Ltd. 2021-12-07 14:18 VT 8/70

Driver Name: savitar2k.sys
MD5: 9afcbc78a43f079c9be8e14648bb4fcc
SHA1: 155b20965d105d4ce9606d0698ea066146243e74
SHA256: 46aa86095904f54549bf2ab84ef44d0ece8104a2de2f3e8bbfad743cf1410b53
Imphash: 9a4a2e5cede0beb19eba662f7f5a1e4c
Vhash: 084066651d16551569z26z35xz
Authentihash: 9afd7c99bf801c69029e83631e51edf0c8e5cdbda7c18a31ab67007010de275e
Rich PE header hash: 50e4a382f117bcf889fb64d10031280a
SSDEEP: 1536:umo5DCLD18HOi1S8b83bPf5Q+XG5nR7FW9Fogdb00/xme2PFzv:umP18F118L6+XKR7FWAKkdj
TLSH: T17F837CD3D6100C63D6C65970B2E8E3176F38EF470A9050FB8B25C8C45A61BD2EA6836F
Signer: Shanghai Zherui Network Technology Co., Ltd.
Signing date: 2021-12-07 14:18
SpcSpOpusInfo: kuaigun; Shenzhen uassoft Development co., Ltd.
VT detections: 8/70
Compilation time: 2021-10-10
PDB path: E:\Project\SmallProject\netfilter\netfilter\build\bin\Win32\Win7_Release\tdi.pdb
Country submitter: United States
Flag: Malicious

Description

A kernel-mode TDI filter that attaches above \Device\Tcp, \Device\Tcp6, \Device\Udp, and \Device\Udp6 via IoAttachDeviceToDeviceStack, intercepting every TCP/UDP IRP on the host and forwarding them; configured through a single IOCTL (0x220364) on \Device\Ctrl.