i8041par.dat

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-12-22 04:19 VT 9/73

Driver Name: i8041par.dat
MD5: 4d4f31b625780c5dc67cc9f8035cf9e0
SHA1: e9191f64c3b7457650b813bfe4aa7b9fa9978f44
SHA256: 70c6c4284dcdab01fa0aef892937acc3681c47fe0fa03a36e9e3bbbfcc8610ee
Imphash: dd40f5b51f0c60504774fe5ba71e8a7b
Vhash: 126086050d050e06077519z17z1xz
Authentihash: e4d12dd0967e59d3b194995e8ebde4decdcc523b78b08896812ec340b1bb2a33
Rich PE header hash: N/A
SSDEEP: 49152:Ezt8EEKc7Je0APdIr0j308+CsVLiKPR/W6UPePV8bSSxK9bBio3npDR49tdgy3PE:EOHKcNLdrE3LAL9j0EfZ
TLSH: T138D5F1BE22987358C45E88744433FD49B1B5572E06F8D5AEB1DB7AC07BAF811D902F0A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-12-22 04:19
SpcSpOpusInfo: 广州极智信息科技有限公司
VT detections: 9/73
Compilation time: 2021-12-20
PDB path: N/A
Country submitter: India
Flag: Malicious

Description

kernel loader that download a second stage kernel driver and loads it.

IOC:

hxxp://walmartgood.com:24238/auth.bin

hxxp://walmartgood.com:24238/auth7.bin

hxxp://exxongood.com:24238/auth.bin

hxxp://exxongood.com:24238/auth7.bin