c664fc54853d9b50d7e33bad5bd7070e.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-16 04:19 VT 48/73

Driver Name: c664fc54853d9b50d7e33bad5bd7070e.bin
MD5: c664fc54853d9b50d7e33bad5bd7070e
SHA1: 3a49efb4cf120b01479c4dd705d8de403e184488
SHA256: 5d0d5373c5e52c4405f4bd963413e6ef3490b7c4c919ec2d4e3fb92e91f397a0
Imphash: 03510bfe4b340aa469668e8cb34e8b86
Vhash: 044066651d1516551iz4fxz
Authentihash: f05a1df10900b05fb7211f3dadd15003fc91cfa28a08bcc6d7afa02cd8ab3d5c
Rich PE header hash: a47d93f02dee54ad56542d814d001142
SSDEEP: 768:ThgiDwVO2SNulsMie6NPqjSgyAFhF4M6ut+ZX2PEroemfH4bOtOS:lgQwrHiXN2pZxwX2PXeSHuOz
TLSH: T149237D8565A804E6DAA7E978C2A69617FBF074651311CBDF03B0899A1F333D0FE36B41
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-16 04:19
SpcSpOpusInfo: Globalsign 中国
VT detections: 48/73
Compilation time: 2021-03-16
PDB path: C:\Users\omen\source\repos\netfilterdrv\x64\Release\netfilterdrv.pdb
Country submitter: China
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u