90831-fb21b6571b6ef587d85f476bd302f97a
- Driver Name
90831-fb21b6571b6ef587d85f476bd302f97a- MD5
fb21b6571b6ef587d85f476bd302f97a- SHA1
4146c1ea2799304945aef7fe6974c3469dc49eee- SHA256
86924ac0b1f93cd70dd5103f17776bc9b70326dc9ee2ed5421b9b548c2833e08- Imphash
a29c052d6d153a5736168fa3994167ae- Vhash
016086555d55761656651iz64xz- Authentihash
a946d236e799d8c17e01eba0ad2a8da4b2181003c0d1c8464626cfe9c4161ce4- Rich PE header hash
b3fc885f5d0ef16f298ee2ff24ed3770- SSDEEP
24576:hNyQXlOjGsTER9poTqLpb/Kot77v9mac+hcomR55iod64mad0PyPVYkxGsQ62Cpa:hhlOQjpOqtKixgEykomCP+CzA- TLSH
T179856A65E31B1298CC75C4B0956A3916A4723E18C3BD5FF3E395BFA0A74B5D0A239F08- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-06-22 06:54- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
41/70- Compilation time
2021-06-22- PDB path
E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb- Country submitter
- China
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz