58c6ee99d244faede330e8289da059d3.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-18 13:07 VT 42/74

Driver Name: 58c6ee99d244faede330e8289da059d3.bin
MD5: 58c6ee99d244faede330e8289da059d3
SHA1: 45f522fc74fdb7a73842ee8e226584f483e3fbc5
SHA256: 6a6db5febdaf3f1577bf97c6e1e24913e6c78b134062c02fd1f9875099c03a3f
Imphash: 66132bbc02029fe08f5b7d3ef367d012
Vhash: 024066551d1516551iz11xz
Authentihash: cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec
Rich PE header hash: c760e0b7c9b39841e405ef93f7f13f7a
SSDEEP: 384:QtfYg7QYQbpsEjh5sxxSDKb2rr8rPFR9NZlSlGsjl:QumTPb2H4bDG
TLSH: T1A2D26CD32BAC54C7EA62A4708250D283BA7FF787170195CB0A57C6660EA3FC5DF35928
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-18 13:07
SpcSpOpusInfo: Globalsign 中国
VT detections: 42/74
Compilation time: 2021-04-18
PDB path: C:\Users\omen\Desktop\新建文件夹 (4)\x64\Release\netfilterdrv.pdb
Country submitter: China
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u