← Back to malicious drivers

8d4db7a10fb06189dba5986fd22b8d92145b73fb2b816e2ad6f83d8d76b13d75.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-10-11 02:08 VT 21/72

Driver Name: 8d4db7a10fb06189dba5986fd22b8d92145b73fb2b816e2ad6f83d8d76b13d75.virus
MD5: 50d13758b811c794bc13769ee3b42e85
SHA1: 211d0d8ed32d5e6299f2b849bad969b1c6bcb75f
SHA256: 8d4db7a10fb06189dba5986fd22b8d92145b73fb2b816e2ad6f83d8d76b13d75
Imphash: 5dae50bef5c618444931eb031e49367c
Vhash: 045086655d155e5e6f7519z17z1xz
Authentihash: 1e1a4cf912d0b641a1126bbe68b28a38440b917de516f4e7f1769539bb364512
Rich PE header hash: a35017c2d6b7cc357a17d508d2d56461
SSDEEP: 6144:7j7+qphrCMz6VVlVx/MJncUio8hnR2EIUGVOVaZ9//vjcE5sH788HGjfgPB:S8rjS/CcV3RRhI+Wb7GQMGcB
TLSH: T1D594AED3F2850CD7F31AAD7C81EA66A2B53074A7C724EAEB554412850E563E8D83D33E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-10-11 02:08
SpcSpOpusInfo: 长沙林游网络科技有限公司
VT detections: 21/72
Compilation time: 2021-09-10
PDB path: N/A
Country submitter: Italy, Canada
Flag: Malicious

Description

Kernel-mode droppers (kernel loaders). Their core function is installing a second-stage kernel driver fetched from the internet as a boot-start service: they write it to system32\drivers\.sys, create a service key with Start = 0 and Group = "System Reserved", then call ZwLoadDriver, retrying every 300 seconds on a download failure and every 180 on a load failure until it succeeds. Alongside this loader core sits a traffic-hijacking layer that rewrites the system proxy configuration and seizes the default browser handler, routing the victim’s web traffic through attacker-controlled infrastructure.

IOC: hxxp://drive.sf218[.]com/drule