601d856cba15b3b29cdd75d5e54e4b9b70fef552d6f1aa61e2fdde537cf85041.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-09 11:35 VT 43/71

Driver Name: 601d856cba15b3b29cdd75d5e54e4b9b70fef552d6f1aa61e2fdde537cf85041.bin
MD5: 0b4a0fe7db8400ef65ce7618177351cf
SHA1: 7c60d629a8620e7d8edc45e173dd300b745a6bec
SHA256: 601d856cba15b3b29cdd75d5e54e4b9b70fef552d6f1aa61e2fdde537cf85041
Imphash: a29c052d6d153a5736168fa3994167ae
Vhash: 016086555d55761656651iz64xz
Authentihash: 3b0ea9e540e90b9262bd59cb6a7e04f65e2b04f934e5f45b51ee92fd2a2b2099
Rich PE header hash: a3ddbc5f89dc64073299166fd2e08a0f
SSDEEP: 49152:gYe4MHXgpOqtf7nUgUpCmM6D4GRsu4QDm8bVd:JsHX3ukeNuNVd
TLSH: T1F2956B55E31752A8CC35C0B0A57A7913A5717D18C3EC1FF6E3C6EFA0A70A6D0A279B48
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-09 11:35
SpcSpOpusInfo: 福建奥创互娱科技有限公司
VT detections: 43/71
Compilation time: 2021-07-09
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: South Korea, France, Italy
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz