18f71fc3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 10:54 VT 38/70

Driver Name: 18f71fc3.sys
MD5: 4d947e4163e8aeafbfc626eb033bc665
SHA1: 44af8ee4c2d89c420e6a409a547bd780de3dacd7
SHA256: 6e6acc00afdb254d855c1adc5f27386ccfd398f4d893c44238c6ac596f8a3132
Imphash: b347363cc4af0547e8fd5638e6b23742
Vhash: 016086655d15761656651iz6yz
Authentihash: 67357fba3cc9a5bc72c204bc9ae1ec69ad0e23536aa6be998c46a240901f5058
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:zTTK46trP7dejNHksGPFzvQwIfEUl5YyraUqm2JD1CMvFPwaxw2Tf4YM:zTTd2PYjNHkNvQFfdTYyimWCAPwaxZT6
TLSH: T10455BF9C6244336CC42EC43092276D0AF3B5621E47E8EAEB77D7BA907BA34D0D525B4D
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 10:54
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 38/70
Compilation time: 2022-06-30
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: HU, United States, Malaysia
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.