984610a8.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-07-10 10:54 VT 45/73

Driver Name: 984610a8.sys
MD5: a7251aad1e81c6194b34dabf6edd6b4a
SHA1: c6b26c1c68582bdb8e005c11c370b14758916516
SHA256: 703398b4035af4058d3e2222b6cf08ad4488907af62607b8357311b47a07adbd
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: d735c57e570fcc76812d856ac42ebbdbcda1b7e04a9782d1bdc3b0bfa0518916
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:Tb7OOOw2a7fTJRe9pjkU7F04YYV54bZnboiHmKMPWamkk2H2R5+KOU8Q:TFOk+9pb1V54bZnbnmKcueu56Q
TLSH: T16E65AEA9D3467398CC5A84709127B816F1712E0E43FC4FEBF2D7BBE07B961A09159B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-07-10 10:54
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 45/73
Compilation time: 2022-07-09
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.