947c83dbf5fefa3c6491f0916b51951bda8883302e0ddeb0e4a519515ec575ab.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 42/73

Driver Name: 947c83dbf5fefa3c6491f0916b51951bda8883302e0ddeb0e4a519515ec575ab.virus
MD5: aba1be25da0691761f593725e9c067e5
SHA1: dee0868a359fa47980c8b9a27e319db6946b84d3
SHA256: 947c83dbf5fefa3c6491f0916b51951bda8883302e0ddeb0e4a519515ec575ab
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 17dcf7894740d7ab453b11abf2eb0e3fc3f3ac1eb445d575c6e18ddd10d10b45
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:+7GwFF3Tcn4NMbmp+wKwl3feaKPgVQx8IhUwJcj35QHIzrsqprV5HvGU:+jTTc4NMo+TwQaKPgV8NE3O0rF
TLSH: T1CC65AF6EE35373A8CC1A84385037BD06F1B12D1B43EC4FEBB7CAA7D06B5A59095A4706
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: United States, China, Italy, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.