N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-12-28 08:16 VT 30/73

Driver Name: N/A
MD5: 8bae6c78f843b9530d221bc84be044a0
SHA1: 365cbb53372fb67429aa558b874815bbf792e946
SHA256: 47a34b310dfa5b96a17e21dffae375f5b6abacfea5e7ff226af47adff090919f
Imphash: 3ccdc0b8bbc77cf41f6e8dabbc4e2ba1
Vhash: 065076655d1556551559z16z41xz
Authentihash: 4141f94b33176841aef854f926e5e34d8e55913e5929cb611286bfc24293bc39
Rich PE header hash: cf2474d911c48681941fed92a88ff397
SSDEEP: 12288:eLDdWcwZt1hOtbUyBq5zhwh4FiGPwJlmTaxtWWTwnIIa6vNWvI:eLJWcwZfItUyBq5zhQ4FiqwJy+wnIIaC
TLSH: T1FAD47BC5F2500BEDD5368234C4526137E7F0F48923A1CBEB45AA8A7B8E076E75E3A744
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-12-28 08:16
SpcSpOpusInfo: CHONGQING XIASOFT TECH CO.,LTD.
VT detections: 30/73
Compilation time: 2021-12-28
PDB path: N/A
Country submitter: India
Flag: Malicious

Description

A kernel loader that pulls drivers over WSK TCP (C2 fetched from the registry), manually maps them, and runs them in kernel space.