N/A
- Driver Name
N/A- MD5
8404dced9ed83d5ad0fbf17c0b0c9635- SHA1
851a2a79cbe8ef20a548724370025d4c81565ac1- SHA256
61b3d7fcd83c3fcbd910e9cd285ffdc20d2ad536e53070edc3a8860ead04c1ad- Imphash
c8bf7acf6497b76ad58721e796f9a882- Vhash
015076655d655616551iz55xz- Authentihash
58ac447a8d3677415febe5fc44c6d1528076190462da925da4457b1ee20929fc- Rich PE header hash
60d68ccf8f859bb3239ac7db34c3506a- SSDEEP
3072:4v2CUOSxYFZ/eKTzB0IizjQOsbJ/oMMOvOpqqRT1g:4vKOSUZzzWYOMJQMMO2pqqRTO- TLSH
T124043901F39382E4DD6785B4CA4A600BD2707C05A33D9FAACF92BA705F33B81E569257- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2023-02-22 03:36- SpcSpOpusInfo
海南企凡科技有限公司- VT detections
34/73- Compilation time
2023-02-17- PDB path
D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb- Country submitter
- China, United States
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.