N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-02-22 03:36 VT 33/71

Driver Name: N/A
MD5: 7b5ab1f5e2496060c25ffdbdb6ca56f1
SHA1: e22af6e9eda7ebe9a6d4ad6fc1b06f5e2d4ce585
SHA256: 80756171d740cbc4f316b014b305cd2873763b25e438028b6caaa366e0720ae4
Imphash: c8bf7acf6497b76ad58721e796f9a882
Vhash: 015076655d655616551iz55xz
Authentihash: 473138c7b67c82609915a039909eb3d70f34efc04d76afb2f4de0488bd03a86e
Rich PE header hash: 60d68ccf8f859bb3239ac7db34c3506a
SSDEEP: 3072:Bv2CUOSxYFZ/eKTzB0IizjQOvbJ/oMMOvOpqqRSKxY1ET:BvKOSUZzzWYOzJQMMO2pqqRSKy1S
TLSH: T14C042801F35782E4DD6785B4CA4A600BD6707C05A33D8FAACF92BA705F33B81E56925B
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-02-22 03:36
SpcSpOpusInfo: 海南企凡科技有限公司
VT detections: 33/71
Compilation time: 2023-02-17
PDB path: D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb
Country submitter: China, France
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.