KB_VRX_deviced.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-17 12:24 VT 41/73

Driver Name: KB_VRX_deviced.sys
MD5: 262c92f2437c80adf232ef147ca2d734
SHA1: 939dfc5f356216686c509fa6ff4b69bf62f1c68f
SHA256: 923e19677234b9343122c4dd7cd5e6864c2981c73590316f1f98b60c2fa70fc0
Imphash: 6a4b1bcf05e6e0a2b1cdcf0be207c18e
Vhash: 016096555d15761656651iz5exz
Authentihash: 0560f00d6e8eecff32885ac1c7d09338e17e062e6c84e6ac151a5c7206f89f59
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:S1xAEIt5ZsGSYba5wNCnQ0Fgxke8nPAauPa+0G5z22HGAqlRK:S1XIlsGP25wwQQgSe8PAa0bGns
TLSH: T1A855ADADE342739CCC2E88748023B806F2B12E0E47ED5FFAB6D777A06B56560D159B05
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-17 12:24
SpcSpOpusInfo: 厦门渝山科技有限公司
VT detections: 41/73
Compilation time: 2022-03-17
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: China, Poland, United Kingdom, Hong Kong, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.