N/A
- Driver Name
N/A- MD5
94c40f6f78f37f97a1d0472950835e3a- SHA1
ffdefb94870bcb2fa78bfd9c7b0e87d5688cadad- SHA256
84b102a056bf4794ecbffde530710de17e1d27ad553ef631025184d43088aca1- Imphash
a29c052d6d153a5736168fa3994167ae- Vhash
016086555d55761656651iz64xz- Authentihash
614369fd5c0f7e9fb1629aa1de40669c3a2d273748303c25e22548b78302dfbe- Rich PE header hash
a3ddbc5f89dc64073299166fd2e08a0f- SSDEEP
24576:Q/iQm/qCNVWYdyWb84OwOyW6lHPoeboBpGBauKkaC2PnqA5l442KJPBmzda:QS/qWBJPoRsB6q2fLlek5- TLSH
T184954925E3179198CC75C0B0A57A3917A5727D18C7AC0FF6E395EFA0A60B5D0A27EF08- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-07-12 08:25- SpcSpOpusInfo
福建奥创互娱科技有限公司- VT detections
39/73- Compilation time
2021-07-12- PDB path
E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb- Country submitter
- France
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz