2gGTklNnFcm.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-06-01 07:12 VT 42/73

Driver Name: 2gGTklNnFcm.sys
MD5: 212b3c513789474c50013692940f8d45
SHA1: b848e7dfa039d9af252332cef03c96123987bc51
SHA256: 46fb636bf6de587d92e60fefb6dd5e025191aff757c10ded5d9f84af8c85771c
Imphash: fd0168b84f82316c4364037edeef11cb
Vhash: 016086555d65761656651iz58xz
Authentihash: 3dacdc064edff32fdbbec9d633fd1d67f6562158d3db420217bc7b3307072f0b
Rich PE header hash: dd22cde23591429c6cfc8560b6834ccd
SSDEEP: 49152:y1lggsfPtyQhG+ryUCwsbmlkrHV2WvnV87UHqs30Oj:yP12gAAwsbdJVzj
TLSH: T1E6857B5AD34362A8CC35C4305523B456F1717E0993BC9FEBB2C2BBA0B7766E0E129749
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-06-01 07:12
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 42/73
Compilation time: 2021-06-01
PDB path: E:\巨灵驱动源码\TotalDriver\x64\Debug\SecondSys.pdb
Country submitter: China
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz