Driver818.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-28 02:56 VT 41/72

Driver Name: Driver818.sys
MD5: e65fa439efa9e5ad1d2c9aee40c7238e
SHA1: 1c3f2579310ddd7ae09ce9ca1cc537a771b83c9f
SHA256: 70b63dfc3ed2b89a4eb8a0aa6c26885f460e5686d21c9d32413df0cdc5f962c7
Imphash: 9321f9c47129fbc728ead2710e22f1a5
Vhash: 034056651d165569z16z4dxz
Authentihash: 7113dee11925b346192f6ee5441974db7d1fe9b5be1497a6b295c06930fdd264
Rich PE header hash: e78033e3940227ef529f8a8c84025c5c
SSDEEP: 768:Ku5AA+mNzR2RHPulZZxL+KDqiLUjp9/Xb3gDw383S0k2UPlKTAMFbcy5D:Ku5AA+mJRMvcZZxL+KDqicpFRs3Sj2fB
TLSH: T19B037E7365D4C4A2F7A2187086A8FB63FC7C69320711A1DB93509EE91472BD2FA3521F
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-28 02:56
SpcSpOpusInfo: Globalsign 中国
VT detections: 41/72
Compilation time: 2021-03-27
PDB path: C:\Users\omen\source\repos\netfilterdrv\Release\netfilterdrv.pdb
Country submitter: United Kingdom, France, Italy, United States
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u