tsocketo.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-01-12 06:38 VT 37/72

Driver Name: tsocketo.sys
MD5: 076a45d28577e6c3ebc36c93d19d3421
SHA1: ff72c7a8677a57853a9ef7dfd40e2f6d63124c0c
SHA256: 5994b6c31d464393b145071f6a054dc7c59a4ff30e1947a406e2d82747713b8e
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 64d0b3801ca8d7cd53960fb6d7bcf7feb7671e2a495d3f13877fe32d84d27a64
Rich PE header hash: N/A
SSDEEP: 49152:JuQCDOqXX3rampKE+7bXF2nyBYEkVQ8bhk7HnS5d0wFP8CyAGsOhqDrgb0gJtGyY:EVemv+cycVvbhkznS5EB58nSd0G4Z9z
TLSH: T1CAF502EA2244731CC01A84B09033FD4BF5B6571E1AE5D56E72DBBAC037EA415EA02F5B
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-01-12 06:38
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 37/72
Compilation time: 2023-01-12
PDB path: N/A
Country submitter: United States, China, Taiwan, Philippines
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.