2_1005.sys
- Driver Name
2_1005.sys- MD5
069877cae35c34124d78d52c71a83771- SHA1
5612385a4249db8b6a76bfd20fb4bc7edc5b5b20- SHA256
52809533edcd92a143dacf0a46870abe0357422bff7485970ec21061594e4e96- Imphash
20e3283683e86ff812ac5e4c390b52d1- Vhash
016086551d65765665151iz3axz- Authentihash
93c84587f8b1f768ecd5f942532836515b25342c9fa544bb68301ed2b6a0b356- Rich PE header hash
5a8d67f1148a89a19aba9fba85668b53- SSDEEP
24576:g4Cs9/rky4MgBU3jM94MB9RVSWgOoTZBHSLe5sRElnWu5LwujiBFxO58hv:oQIhMVg/B9RVS5T3HSjQ5LwujiBFxOWl- TLSH
T1AB659E5AE30763ACCC65C4B092237956F2703E0C87ED6FF6B2C2A7B07B966A0D519744- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-02-06 08:17- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
40/70- Compilation time
2021-02-05- PDB path
E:\ColdProtect-2\x64\Debug\Fsfilter264.pdb- Country submitter
- France
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.