A946D07DFCA5.dat

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-10-26 13:52 VT 30/72

Driver Name: A946D07DFCA5.dat
MD5: 0fb8cd8da92195c8016050eebaa6f9a3
SHA1: 23ddf5ca648560c902aa23ed7be21cc208e7259e
SHA256: 4bdca907e7f313a9d9b620a10bf3215965c94a82a9b76c3d9aca492656858bd3
Imphash: 5db957e86e21991d28846f3f127cb562
Vhash: 026096050d0506060d1779z17z1xz
Authentihash: 6be1464506a465f6e1e6925076067444a76bcf2679397877d363d629a43398ff
Rich PE header hash: N/A
SSDEEP: 49152:kNTxccqhz8InaxorENeDmGfiPEN1qxmZWUiGnrzzzDzSqd8JB/BsDYm:MlqhzbEZGKPENcUW9aDvsl8/
TLSH: T15BD501AD614433ECC41AC5389433FD46A2F6521F4BE999FA71DBBAC0779B820E942F05
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-10-26 13:52
SpcSpOpusInfo: 广州极智信息科技有限公司
VT detections: 30/72
Compilation time: 2021-10-25
PDB path: N/A
Country submitter: China, Germany
Flag: Malicious

Description

FK_Undead is a kernel-level (Ring 0) Windows rootkit family that intercepts and manipulates network traffic. It routes all browser traffic through attacker-controlled proxies via PAC, blocks antivirus sites, injects code into web pages, and installs its own certificates to intercept HTTPS. It also blocks rival malware by refusing drivers with certain signatures.

IOC: 121.199.79[.]216