netdlx64.sys

Malicious 迷南文化传媒（上海）有限公司 2021-10-26 15:02 VT 31/74

Driver Name: netdlx64.sys
MD5: 227842280eb9ad632ba24ee7ad2d8d26
SHA1: ab5a3155bb0dc45e12bbd37f14f336909daaa30e
SHA256: 4c14061f57c08e7e429d32aeea450f271a1828841755bf2ade5dc28346c9655f
Imphash: dd40f5b51f0c60504774fe5ba71e8a7b
Vhash: 126086050d050e06077519z17z1xz
Authentihash: 6b7811e1e96716c339100a13cdd91d69b4be07059625996074ad9ee74801515e
Rich PE header hash: N/A
SSDEEP: 49152:SvdY+2fqcdpC0eAJNK6sqFvuGg9q9XlEJ6hWQgm8WmFskFOdNLm5P61mHBP0gmc9:SvW+7cPKjqFWGxXM/B29mh8o9
TLSH: T123D5F1FE62543318C41ECD349137AD48F2B6402E1BF8956AB6DB76C0BF27811EA16F09
Signer: 迷南文化传媒（上海）有限公司
Signing date: 2021-10-26 15:02
SpcSpOpusInfo: N/A
VT detections: 31/74
Compilation time: 2021-10-25
PDB path: N/A
Country submitter: N/A
Flag: Malicious

Description

kernel loader that download a second stage kernel driver and loads it.

IOC:

hxxp://walmartupdates[.]com:13238/auth7.bin

hxxp://exxonupdates[.]com:13238/auth.bin

hxxp://exxonupdates[.]com:13238/auth7.bin