660ad1fd6cdbd9b8627a7a6bb7af3c367d2d77fd382639b6d9d8d287a15d7a3d.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-18 08:32 VT 37/73

Driver Name: 660ad1fd6cdbd9b8627a7a6bb7af3c367d2d77fd382639b6d9d8d287a15d7a3d.bin
MD5: 66d2860a078fb11832ceef28b23481c2
SHA1: c815815f59c5f6a179404eb2ff4051071aa47072
SHA256: 660ad1fd6cdbd9b8627a7a6bb7af3c367d2d77fd382639b6d9d8d287a15d7a3d
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: 9a4dd9791ff85b89e26c7e2804782f7b3037386d44155ad4a966942755014063
Rich PE header hash: 90d5dc71ed6403571c4221ac4ebb1557
SSDEEP: 24576:kCaByfxON2to579KjwOPzVOrK7rfR6QRLnPzFW4nkGUBfdCH+efp6IdiRVABvNRl:drfxON2tWMLPJ0+FhlWmmS+efp6IiVAH
TLSH: T18255BEED7244336CC46AC574C133AD0AF1B1620E53BAD9EBB3C676A03FA74B0E525A45
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-18 08:32
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 37/73
Compilation time: 2022-06-18
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: Italy, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.