4b267203d6cbe5ca72f9f47446153ab62a2f99a0ae0788173cfefe61ba936f6d.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-29 19:21 VT 35/72

Driver Name: 4b267203d6cbe5ca72f9f47446153ab62a2f99a0ae0788173cfefe61ba936f6d.sys
MD5: 4ee87604400e37ab8712b4d5ad5b863f
SHA1: 9fc936b0436e80172019248105bb791e22d3bcf7
SHA256: 4b267203d6cbe5ca72f9f47446153ab62a2f99a0ae0788173cfefe61ba936f6d
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: cde4885bfd7773946dad55efac260574bbfb8c8855f602205a3108e345fa6446
Rich PE header hash: N/A
SSDEEP: 49152:H3CCQvPJWjjiiAJI/M0fxnYNyzA7MEKGPy+SA9/6CG+ZxvH46xyiSc69QwJ/HVT5:yC2PJWj2f+/hRbzsKGK+SCdBS/T40T
TLSH: T15806026D2198379CC02EC5245133ED45F2FA522F0BD9D5EAB2DFBAC077AA411E502F1A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-29 19:21
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 35/72
Compilation time: 2022-12-29
PDB path: N/A
Country submitter: China, CZ, Taiwan, United States, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.