vpn.sys
- Driver Name
vpn.sys- MD5
26d6833b1875b138ea34d6ab430cafcd- SHA1
80a5d77674d798989af56fa3ad11fe899e7e1d48- SHA256
4865c64ecafb34ffcd0f0922558f7ea1c78c099b99dfef03e522cff7b2f98db2- Imphash
6663243007db0e0257030c153f75303b- Vhash
016096555d15766656651iz79xz- Authentihash
4b4d98b5b94845404bfbcf01d2a3e478a4a805ff1e227b0176b3c485ef2bca6f- Rich PE header hash
26475e631a56bf9d887918ad79870da8- SSDEEP
24576:dpcAy1g7fTtpqZo9Nv/cpflOSzsE4NIGqSYrlC6LUBB44Xj582DsZhIqWHA4cJlW:IArPLqZ4NvEZl9zsPIeglPgBB4yG2I7Y- TLSH
T16A559E7ED3066358CC6A887091237945F1B12E0D4BFC4FB6F2E7A7E06B9B960D119B06- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2022-02-07 03:47- SpcSpOpusInfo
厦门恒信卓越网络科技有限公司- VT detections
40/73- Compilation time
2022-02-07- PDB path
D:\speeder\speeder\vpn\Mydriver\MyDriver2\x64\Release\wfp_vpn.pdb- Country submitter
- France, Italy, China
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.