6b372a47384872aaa703350ec37686372fd7eddf2145b8bf419a16145e966478.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-01-09 09:26 VT 35/73

Driver Name: 6b372a47384872aaa703350ec37686372fd7eddf2145b8bf419a16145e966478.sys
MD5: bd0455cd6aaf850df617aabfb405d5e9
SHA1: 906dd3a6ae682bfb8cc2c3c4ba49bcad9746f417
SHA256: 6b372a47384872aaa703350ec37686372fd7eddf2145b8bf419a16145e966478
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 8ccb3c61285f895cf27e04476c6a3bedd9e0860a9aee409506867b2b98861133
Rich PE header hash: N/A
SSDEEP: 98304:9gQpaxxJc2jm2cGqjrHfC8I+Tb+l4XsIaMur5AZ9+:fafJcYmxG2rHfPX+lKaNyG
TLSH: T148F502FA61943318C01AC9346433BD48E2B6951E0BE5E9EE76D7FEC06F6B412D911B0B
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-01-09 09:26
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 35/73
Compilation time: 2023-01-09
PDB path: N/A
Country submitter: China, United States, Japan, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.