N/A
- Driver Name
N/A- MD5
79ac320e21ca05aa1e18cba57636243f- SHA1
e91b9f4d122b1fc0e5c9e7e7bcbbc5be4fe3ff4b- SHA256
4ae4a3b2d4b5731c87df5b82aba830d0f8ac60b0766813c9f0d4698a0c16c79e- Imphash
c8bf7acf6497b76ad58721e796f9a882- Vhash
015076655d655616551iz55xz- Authentihash
c199399a4c139c11d711d1945ab892ba332a0e94b166d35d81a9701ec610e262- Rich PE header hash
60d68ccf8f859bb3239ac7db34c3506a- SSDEEP
3072:bv2CUOSxYFZ/eKTzB0IizjQOAbJ/oMMOvOpqqRKCxY6P:bvKOSUZzzWYOQJQMMO2pqqRKCy6P- TLSH
T105042802F35782E4DD6785B4CA4A600BD2707D05A33D8FAACF92BA705F33B81E569257- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2023-02-22 03:36- SpcSpOpusInfo
海南企凡科技有限公司- VT detections
33/73- Compilation time
2023-02-17- PDB path
D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb- Country submitter
- China, France
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.