66f295833189be5f3e4d1ddb253bbd7ccd3e810c1ae8db9289662a7ce2b2fa35.exe

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-18 08:32 VT 41/73

Driver Name: 66f295833189be5f3e4d1ddb253bbd7ccd3e810c1ae8db9289662a7ce2b2fa35.exe
MD5: 07aee6a8f4f20d0dfa424cfe521b9d9b
SHA1: 7231bffcf87a7649c50ec9d4331be38f68a8db25
SHA256: 66f295833189be5f3e4d1ddb253bbd7ccd3e810c1ae8db9289662a7ce2b2fa35
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: 4120e07a5cfa2d3ebdf2f34abc4444c6296b24ee1d1c26847c1650aa6abc61e7
Rich PE header hash: 90d5dc71ed6403571c4221ac4ebb1557
SSDEEP: 24576:PYa2dwxsoyCrki677/J7lVawVxipI/W/fg0Y6K9KRFBV9936FWe7YwCa+PAbj14s:ADwWCr+l7lVa2FLj5KRFBVn34h7YwmP4
TLSH: T1C855BFA97244339CC41AC1349133FD46F2B2261F43E98AE7B3DB7A903B664E0E565F46
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-18 08:32
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 41/73
Compilation time: 2022-06-18
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: China, United States, Hong Kong, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.