972f470d7759a095aa7b577dd3cafab8f3c6234531d105784ebff528958b4066.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 42/73

Driver Name: 972f470d7759a095aa7b577dd3cafab8f3c6234531d105784ebff528958b4066.bin
MD5: 286b10451fe364310f4a7baeb0e94a3f
SHA1: 2d800c4a29dab48d0af2d952d13a1044668706b7
SHA256: 972f470d7759a095aa7b577dd3cafab8f3c6234531d105784ebff528958b4066
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: fbb5466e5b582ffb50d9fe7eba0703d55f0ff03742279bdf00bcd1855efa3d4f
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:77ewFY8moF7O3EyjogBCPHUDwioNtVJyRy5WPt6rQQ5B2X4TDfKGQe+umCasu83L:77FmSfTgo25onryRy5W4sQ5B2XqDfKG/
TLSH: T1A7659D6CE34362A8CC6EC4308527BC46F2706D2A43EC6FF7F2D667A07B565A0D169B05
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: China, Italy, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.