netfilter.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-05-16 05:58 VT 45/72

Driver Name: netfilter.sys
MD5: 0bd3b9f55a2d3a13f506d9d8b970e0de
SHA1: f023177aca17f6dc90fdd9588240cb16c70a9fe2
SHA256: 63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0
Imphash: d252001e327cf09463aba69fb4de2125
Vhash: 054066651d1516551iz5yz
Authentihash: 5c206b569b7059b7c32eb5fc36922cb435c2b16c8d96de1038c8bd298ed498fe
Rich PE header hash: 85bc198af7e82d3ad73505bc7086be84
SSDEEP: 768:o1ZqCQKy8IYdfWiUelR36ihR6nmRYsOSHjS/OPNi7HbB:oNyq+4lRX6IHOSyOVi77
TLSH: T18B438E95A2A814D4CA67D5B8C1629A1BEFF17462232187CF03B1C5950F733E0EF3A795
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-05-16 05:58
SpcSpOpusInfo: Globalsign 中国
VT detections: 45/72
Compilation time: 2021-05-15
PDB path: G:\源码\hello\x64\Release\netfilterdrv.pdb
Country submitter: Poland, United States, Germany
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u