N/A
- Driver Name
N/A- MD5
bbd3515f3ca6357bf94f94ba767d698c- SHA1
53db30ed44cfc85afefb6db51d3628895cf6d89a- SHA256
74205673dd6d053afe7c845bc600ed29e57e5fa840d5aa10b2ae84bb4af03342- Imphash
c8bf7acf6497b76ad58721e796f9a882- Vhash
015076655d655616551iz55xz- Authentihash
89188bca2b128394dbad1dea6dad80439500c3acbf2d342eb65fd0815ce206eb- Rich PE header hash
60d68ccf8f859bb3239ac7db34c3506a- SSDEEP
3072:qv2CUOSxYFZ/eKTzB0IizjQOvbJ/oMMOvOpqqRvzB:qvKOSUZzzWYOzJQMMO2pqqRvV- TLSH
T1FE042901F35382D4DD6785B4CA4A600BD2707C05A33D8FAACF92BAB45F33B90E569257- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2023-02-22 03:36- SpcSpOpusInfo
海南企凡科技有限公司- VT detections
34/73- Compilation time
2023-02-17- PDB path
D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb- Country submitter
- China, United States, France
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.