osmefx9.exe
- Driver Name
osmefx9.exe- MD5
d6e506a1e0417c4507a5314529d84e34- SHA1
059055c1e7583703daadd8c88d84eebdb1f77dd9- SHA256
703251a74ad18298f4ff2a0c58ee7543827e39ae2974d504d07ae2f039b7cfbb- Imphash
ae14168e71151f57d9acc21992fb9812- Vhash
016096551d55761656651iz62xz- Authentihash
3c9f422a069a26a8ffd1c15bd410febb0e11c79e0d24ecc49b60c0f62804780d- Rich PE header hash
444289698dc0195c99d0e3905b94e916- SSDEEP
24576:pMMwi5AcmNDnRkQRVLnKTkyU+/MWSL095ND4rlxS2JLEaLlMVqNxqbBOMGOI29TB:k4EuuuAqk1095NSxBRyq6lT3fqMfi6- TLSH
T106956C5AD307A2E8CC69C47095277916E1707E0883FC1FFBF3C29BB0BB566A09569748- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-03-19 13:05- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
35/73- Compilation time
2021-03-19- PDB path
E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb- Country submitter
- France, Canada
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.