1a7603.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-07-06 09:18 VT 44/73

Driver Name: 1a7603.sys
MD5: 9d1424c87d89095e3cd6785adb54d2ec
SHA1: 255ba4ffd55cc96dc6351e4a0ae60854fefd8c5c
SHA256: 89dbd7971a515fffe7635137e87955bda6d22e14305dd97dfa5b348bb5dd4f2d
Imphash: b347363cc4af0547e8fd5638e6b23742
Vhash: 016086655d15761656651iz6yz
Authentihash: 4a446ba36de5752fe33948d4de7ce8d20106201469965bb8f186ade2c72ca901
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:SWY3mNWGMEJMxJDGdHa+NumT5SoLO2wKOVydraXSO4iFB/k1P6VTUe4aaSU:SW3EG0DaNdG2waradVCPwPSB
TLSH: T1AA55BFED6248335CC41AC9308123AD19F1B1761E4BBA46EBB6DB7AD07F9F4E0D525B02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-07-06 09:18
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 44/73
Compilation time: 2022-07-06
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: United States, France
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.