N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-28 07:25 VT 26/70

Driver Name: N/A
MD5: 464e4b669486ba77ccb59cb32a1230be
SHA1: 11e53f5c8ec04ee9c97790f8428ff02653c74a73
SHA256: 78dc71be0a790513491c61306af29bcdc028c3033a9b8cd54d4c65c9f21fe75b
Imphash: b1865abddb6c5311c70e061e2caef8db
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 5f58cd2e4a097d9b6334bdf394cb2ae4198b2d2bb4303c21971b7a5cbe9f512f
Rich PE header hash: N/A
SSDEEP: 98304:S56POFuGBCMUMyoVSY4WKO9/4Tw/hPkj+MU:SAPOFuGvUMnVjmk/ZkjhU
TLSH: T1E3F502ED2298335CC01BC8789937EE45B375621F1BE6A5AE75CBBAD0779E410D602B02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-28 07:25
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 26/70
Compilation time: 2022-12-28
PDB path: N/A
Country submitter: United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.