vpn.sys
- Driver Name
vpn.sys- MD5
f3263ba324f720940dc2e80713fe0d92- SHA1
e3c41fbfe33a00d96a57e3f2106f80a446bf1fc1- SHA256
4d89b7cb2f01f5461ec30fec311e25284680111d69d5e9e8e98b274f2b5e38a0- Imphash
c4110de9fddcb44c9133bf3e705b09c7- Vhash
016096555d15766656651iz7cxz- Authentihash
46e498fea63587d9d0f44f97f7c1400c3620a062e1c7b8839961e0f32642885e- Rich PE header hash
2727c7cde3e2a5cb12fb6e08c10ff5f2- SSDEEP
24576:LNfFVQybBzeJ+RbkS5W64S2Y/2Hr5Q7NdAa5Yv/QLcT/Ree:LNfoyJCXS8BBY/2lQBy3QLq/Ree- TLSH
T135559D2DE347B3A8CC6A88705123F905F1B56E1D43FC8FBAB2D2EBD06B5B5109519B06- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2022-02-18 06:58- SpcSpOpusInfo
厦门恒信卓越网络科技有限公司- VT detections
40/72- Compilation time
2022-02-14- PDB path
D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb- Country submitter
- United States, China
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.