MyFengDriver.sys

Malicious 方正科技集团股份有限公司 2021-08-15 03:42 VT 11/73

Driver Name: MyFengDriver.sys
MD5: cccbed8b600dc3d1e2c22094d149584a
SHA1: e6b3b8e79b909f94b62389090a043a615a6c297e
SHA256: 5c66a2acb2c1d2281044833fb78ab74ca459a41d1720afc7a8296ae4cc1399de
Imphash: 98c3cd896bbbf621e088ea2ad8cf56e7
Vhash: 024066651d1516551iz1axz
Authentihash: b1ecd0e1c53208d4f7be388348fbef4b8dd2727c33bb5213d21a8a2057d2dc90
Rich PE header hash: ea2c56ea50cf96df7adb819a679a3474
SSDEEP: 384:sAOGuB3aJVihpIrG4ZsZZvjpkAoZvdr3dXZyEPH/hH:5uF4ihdkHVhH
TLSH: T1BBB22A62C7241C86EE269D3531D4C932AF30B682B751C2FB4225C4648BC2FD279FC16E
Signer: 方正科技集团股份有限公司
Signing date: 2021-08-15 03:42
SpcSpOpusInfo: N/A
VT detections: 11/73
Compilation time: 2021-08-15
PDB path: C:\Users\admin\source\repos\MyDriver1\x64\Release\MyDriver1.pdb
Country submitter: United States, Canada
Flag: Malicious

Description

a signed x64 kernel driver whose non-exclusive, default-DACL \Device\FengDrv exposes four unauthenticated IOCTLs: remote PAGE_EXECUTE_READWRITE allocation into a caller-chosen PID, PEB-based ANSI module-base lookup with a Wow64 fallback, and byte-identical arbitrary cross-process read/write built on KeStackAttachProcess + MDL mapping. Because the mapping runs in System context, any process that can open the device gets kernel-mediated R/W plus shellcode-planting against every process on the box