vpn.sys
- Driver Name
vpn.sys- MD5
de4b5043c82ab3b36b4ae73a2e96d969- SHA1
0aae562389d510835642ac08b3cf4e39fb421aca- SHA256
6162bf8a5f8359e1e8eeb40d571ddb50ae88c40b8afc3d25dbf6a0db7f75a08c- Imphash
c4110de9fddcb44c9133bf3e705b09c7- Vhash
016096555d15766656651iz7cxz- Authentihash
1e3049f3ef73f98540da329266169dc0a6aea5e5c9fe7d153bcaddfb4fdabf9f- Rich PE header hash
2727c7cde3e2a5cb12fb6e08c10ff5f2- SSDEEP
24576:kNPvsOPBjsjiYepZYym88scCKMvfOsgPDsTBbbjSJduLsyx3IeqOEI+QlhwMF9H:kNcO1sjWtQc9C8fjSJdOsheqN1shwm- TLSH
T15755ADF9E342625CCC2AC830D5277442E1B56A0D46BE4FBAB3E3EBF06B17970E515A05- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2022-02-14 12:25- SpcSpOpusInfo
厦门恒信卓越网络科技有限公司- VT detections
46/73- Compilation time
2022-02-14- PDB path
D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb- Country submitter
- YE, Canada
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.