3566cf998c6b515c66c55227d29a49a1.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-25 18:16 VT 24/71

Driver Name: 3566cf998c6b515c66c55227d29a49a1.virus
MD5: 3566cf998c6b515c66c55227d29a49a1
SHA1: 657a4a313f513df2734244760de014978d2f0c2e
SHA256: 862b205eb40a4274ff78c2bcb7aad77916ebeb2f9d2208b2ea385105f3835817
Imphash: 89a96bf002d66bb66fdc4905a78578a2
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: d46a41f6fff55da6be752a81c7874768e319c2b698b3c2d21a79abce39337189
Rich PE header hash: N/A
SSDEEP: 98304:NiTnr46VlEm7ICW/D4/y/TiQ65RSKUlZx:UrRJITz/Ti5RSKUrx
TLSH: T18DF502FE22443398C41789245433FD89A2B6555E53D8DAEDFADBBAC03B3B411DA01F1A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-25 18:16
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 24/71
Compilation time: 2022-12-25
PDB path: N/A
Country submitter: Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.