7a9df5c46c7c65b807f78c6c0bb2c38c.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-28 07:04 VT 48/73

Driver Name: 7a9df5c46c7c65b807f78c6c0bb2c38c.virus
MD5: 7a9df5c46c7c65b807f78c6c0bb2c38c
SHA1: 9d66842cc5b6078d998ba0595e63cd3f3d22024e
SHA256: 82f5a32fa0ad2ad39876f6a50d13bc9716f528b8defab10448b3946854f1d5b9
Imphash: 6a4b1bcf05e6e0a2b1cdcf0be207c18e
Vhash: 016086555d15761656651iz5exz
Authentihash: a8721477aae50e7455394a1384bf3af97daf97e3784cfb6670d61df84f8fa236
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:lCq+EHKnjUN7GT0qnEdcc+6gJVCDVCf5rbVZhhdcCBQXI2H6KuEkplCWd:lCqkoNNsEdcL6rDV8rbVZ2aQY2aMkplj
TLSH: T15F55B0E9E3437298CC5A88748823B805F1B1AD0E4BBD4FBAB6C7BBE07F5A560D514705
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-28 07:04
SpcSpOpusInfo: 沈阳柯基网络科技有限公司
VT detections: 48/73
Compilation time: 2022-03-28
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.