isodisk64.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-12-28 08:16 VT 34/73

Driver Name: isodisk64.sys
MD5: 0818647bd74a85b7143953ef67e288dc
SHA1: 48c1e0149eca801b817163beae44f40d63bf16b3
SHA256: 81f8103040ea9ae29d6007a263f5a5daeb70a9f939f643786c16735b27d3905e
Imphash: 3ccdc0b8bbc77cf41f6e8dabbc4e2ba1
Vhash: 065076655d1556551559z16z41xz
Authentihash: 4141f94b33176841aef854f926e5e34d8e55913e5929cb611286bfc24293bc39
Rich PE header hash: cf2474d911c48681941fed92a88ff397
SSDEEP: 12288:5LDdWcwZt1hOtbUyBq5zhwh4FiGPwJlmTaxtWWTwnIIa6vN9I:5LJWcwZfItUyBq5zhQ4FiqwJy+wnIIaJ
TLSH: T14AD47BC5F2500BEDD5368234C4526137E7F0F48923A1CBEB45AA8A7B8E076E75E3A744
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-12-28 08:16
SpcSpOpusInfo: CHONGQING XIASOFT TECH CO.,LTD.
VT detections: 34/73
Compilation time: 2021-12-28
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

A kernel loader that pulls drivers over WSK TCP (C2 fetched from the registry), manually maps them, and runs them in kernel space.