savitar2t.sys

Malicious Jiangsu Youqu Network Technology Co., Ltd. 2021-12-07 14:19 VT 8/73

Driver Name: savitar2t.sys
MD5: 36d6f3b4409068a63279ea5b5c198432
SHA1: e945941963523049f3d83ac504307cf2df44189f
SHA256: 8f272ea1e7478c750a043a437d8e2449931468f127685981489a751c4f0d0842
Imphash: 9a4a2e5cede0beb19eba662f7f5a1e4c
Vhash: 074066651d16551569z26z35xz
Authentihash: a2135ea9c89242d3d80b7ef4e64ac8b8e488b888b6e4adac96be11c8281f465a
Rich PE header hash: 50e4a382f117bcf889fb64d10031280a
SSDEEP: 1536:Tmo5DCLD18HOi1S8b83bPf5Q+XG5nRqFW9JojK5cbw:TmP18F118L6+XKRqFWw4c8
TLSH: T170637DD3D6000C73D6D64970B2E8F31B6B79DF060A9054FB8B2489C49671BD2EAA935F
Signer: Jiangsu Youqu Network Technology Co., Ltd.
Signing date: 2021-12-07 14:19
SpcSpOpusInfo: XiongMao; 南京偲言睿网络科技有限公司
VT detections: 8/73
Compilation time: 2021-10-10
PDB path: E:\Project\SmallProject\netfilter\netfilter\build\bin\Win32\Win8_Release\tdi.pdb
Country submitter: United States
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u