8559f0c7c007a7f6dbbf18d9dd807e6a71e525935cfff4ab869c187728b3c65d.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-05-29 05:17 VT 31/70

Driver Name: 8559f0c7c007a7f6dbbf18d9dd807e6a71e525935cfff4ab869c187728b3c65d.sys
MD5: 5e7487037bda36385b1338dd0f9adb32
SHA1: 35aa920cf812c931c2f08b36ea71702b6ec182c7
SHA256: 8559f0c7c007a7f6dbbf18d9dd807e6a71e525935cfff4ab869c187728b3c65d
Imphash: 95f22d6780b9bb23cae4c9010257ba25
Vhash: 016086655d15761656651iz5dxz
Authentihash: aaea77c719b6f92f6ad653e4aa6b225d4d10eeb001c004d91574273a565ce309
Rich PE header hash: 8f4289d0dc5645cc77d887b2fe464134
SSDEEP: 24576:a+QhuN39wfDXTih15I3b4p1+J4DFizimX2OQTFCIerES1x++cuO:RQe3a+hDI3nMHmXWTFCIqES1xyr
TLSH: T10255BFAD6298336CC41AC834D137BD09F2B5661F07F58AEBB3CB7A903B534A0E555B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-05-29 05:17
SpcSpOpusInfo: 厦门沁云网络科技有限公司
VT detections: 31/70
Compilation time: 2022-05-28
PDB path: D:\投影仪\ProjectorSys\x64\Win7Release\Projector_device.pdb
Country submitter: Hong Kong, China, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.