cmqe3.exe

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-19 13:05 VT 45/73

Driver Name: cmqe3.exe
MD5: 52494f624378ef6ee298f0fc73082d0e
SHA1: b4dfa8d2dba707f174f89903367f69f87a0e031e
SHA256: 7f9f18002ddaec6ec88b778ea9585fac7c06045cd817d5d24ceefd00afbfa7a4
Imphash: ae14168e71151f57d9acc21992fb9812
Vhash: 016096551d55761656651iz62xz
Authentihash: 41a064e12083617b2a938f86b871979ea367e1d0560e6286667ea46a65edb063
Rich PE header hash: 444289698dc0195c99d0e3905b94e916
SSDEEP: 49152:w4Wtuuizw/xKktfNX09riElaiZZqhUbDMzL99:w4Lui0Ua0tLZFAX
TLSH: T13B955B5AD31762A8CC71C87096273516F2707E0983BC6FF7B3C19BB0BB536A095A9748
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-19 13:05
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 45/73
Compilation time: 2021-03-19
PDB path: E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb
Country submitter: France, United Kingdom, China
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.