KB_VRX_deviced.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-17 12:24 VT 36/72

Driver Name: KB_VRX_deviced.sys
MD5: c812fa7c628c3e19a3da5910acf6206e
SHA1: 7b0a282c8daeb171f9f69452efe5a82e54937afd
SHA256: 71a12491b91eff58d2c834160bf8eb03be2e78548c9d06f435b31d9e7dcaecd8
Imphash: ff58cd68795212e061ab109b726c8fc3
Vhash: 016096651d15761656651iz5exz
Authentihash: 8774638b1b77665496dde96f1016f498bd91c062a9133d4faef6feeb0b7778e7
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:zvo2/Ym5z60hDZixsDWJjDT8HcvnUnWwOvwM5uK7QOYX:zvo2/BPFZqMQj0HcvnafOdYX
TLSH: T13345BFE96184339CC41BC834C537A909F2F1750F07E98AEB7BDBBA907B6B460E615B05
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-17 12:24
SpcSpOpusInfo: 厦门渝山科技有限公司
VT detections: 36/72
Compilation time: 2022-03-17
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: China, Hong Kong, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.