1824e823.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 10:54 VT 44/72

Driver Name: 1824e823.sys
MD5: d11b9a4664ea03dfe3e8e1d737cd15f8
SHA1: ea10a4e06400900fdbdb1f8b315f83f6fa6b2f97
SHA256: 478919d31d12026fe9ee51d1332701cd5e350b33d2bcf9365b462a1a25d56680
Imphash: b347363cc4af0547e8fd5638e6b23742
Vhash: 016086655d15761656651iz6yz
Authentihash: 3aa92387aad669507799a92f0ed921d6a15ea8199fa831cdaf8e7add264fcb14
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:AewbasoxXNgAWOF/VVgJ5orMKf164bWfvGxhDPKkkalsiA:Aewd2v/VVgm646fihDPXkP
TLSH: T10B55CF2C6299335CC41EC43895376D4AF2B6330F07E84AF7A2CBFA906B975D0D5A5B02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 10:54
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 44/72
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: Philippines, Italy, Poland, Russia, United States, Malaysia
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.