18f71fc3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 06:09 VT 46/73

Driver Name: 18f71fc3.sys
MD5: dd1a5bd34f8cfa56e439c6fb275356d6
SHA1: 185d4322886d70672c9fdc9728408a2d5ece2e96
SHA256: 6a0390769feeb703962e81f70896a1dfd1ea14479b9e200bcc530b238990c759
Imphash: 467798d7c212fab82a6681f61778d791
Vhash: 016086655d15761656651iz6yz
Authentihash: 3f9dbb5dcf473ceaed7a32b055355fd0a86ea8b4bd5ec7f76a64d40d124b627f
Rich PE header hash: 8b68754fc2ef581f2f15b37a4d741936
SSDEEP: 24576:OVMo2nVjLLeE3pg4fbyHAQ8LH0pvgoU6y7+EArT14BmaDiQ:OmrJLLeWZ88LH0TU6y7+E+TJaDZ
TLSH: T13355BFED7144331CC42AC83482236D1AF2B5761E43F989EBB7D7B6A07F664A0E535B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 06:09
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 46/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: United States, Malaysia
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.