7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-11 14:47 VT 47/73

Driver Name: 7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f.sys
MD5: 90b9a4328c4f712815760f9da49bcb6a
SHA1: 521f9f0a60c8def3305be6fe1dd3a83b4452605e
SHA256: 7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: b6191fbda54fba328446966bec7a7208159507a8f64213e2a7202b07af14a538
Rich PE header hash: 8c4317d2b0a85d863c5a1a44385242b6
SSDEEP: 24576:46fJMicU3WhMzUzJEie/PlVgqn2FVwgnLFDjnQO3POCGozIFZpK/3XBDLYCcxj3f:4e5cUXzUz+ie/P8qn2F2gnLFPnQO3POJ
TLSH: T17555D09D3288336CC42AC9309523BD0AF172761E0BF509FBB2C77A906B5B5E4E525B17
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-11 14:47
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 47/73
Compilation time: 2022-06-11
PDB path: F:\socket版\重定向 -2022-06-9 线上 - 副本 (2)\x64\Win7Release\Projector_device.pdb
Country submitter: Turkey, PK, NO, China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.