18f71fc3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-01-14 08:42 VT 40/70

Driver Name: 18f71fc3.sys
MD5: b849deae20052d72c3c623660fa97e64
SHA1: 9dae602ffed6aef29b54c2cd2399c7bc1b0bc7c2
SHA256: 802c3ec59c050c3aaee45b66314d8fc865b5e3cae82645b425cf586402115839
Imphash: ab7801caf39f7703a52354de80bb983f
Vhash: 016096555d55761656651iz66xz
Authentihash: b11f6b6499aceb516c5a34b95da3d180f4b2241426c2af3522074b23001b3d27
Rich PE header hash: be0bb9f89ea53793d8cdee9cc42ae2a7
SSDEEP: 24576:64K0niYkyV3rPm7yQ4zumjDOvnieDcMMHewq/qXSend/U+NW20yD/P/mOMIoOWw1:XGcrfQUSvArq/mSeu+Ky7PWwlBWU
TLSH: T13565BF9AA25D3398C47AC5344433AD1AF2B0351E47F49BFB72CB7A912B536E0D939B40
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-01-14 08:42
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 40/70
Compilation time: 2021-01-14
PDB path: E:\ColdProtect\x64\Debug\Fsfilter264.pdb
Country submitter: France, HU, Taiwan
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.