3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-01-19 10:06 VT 34/72

Driver Name: 3.sys
MD5: 973a0a71617b6d238a6ef52655c02e88
SHA1: c420e3e3e9a8f5fae40b63c824fb88b6ef74504d
SHA256: 94a8263494c35145eb7770fd4a63399541c8c58e3ad8f333c974478e296a5a67
Imphash: ab7801caf39f7703a52354de80bb983f
Vhash: 016096555d55761656651iz66xz
Authentihash: 4891078ff9159aa03e2b551344ed55c000d4085ceb3e19178976a445a70477b7
Rich PE header hash: be0bb9f89ea53793d8cdee9cc42ae2a7
SSDEEP: 24576:E4Kynikky64PmbN7Ee9JyhPy0VWu3aMyJM8P48Q1K5ysGelIX2UgcDydiZUQ04DV:rG+PmxEY+y3u3PyJMojKQysGeG2Ugc2W
TLSH: T1A165B09E624D236CC43AC4348523791AF2B1350D4BB497EB73D6FAC02B679E0D93AB45
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-01-19 10:06
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 34/72
Compilation time: 2021-01-18
PDB path: E:\ColdProtect\x64\Debug\Fsfilter264.pdb
Country submitter: France, China
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.