netfilter2.sys

Malicious 雷神（武汉）信息技术有限公司 2021-03-19 02:42 VT 17/73

Driver Name: netfilter2.sys
MD5: bfad3ecba802c3f9341bededf7e71082
SHA1: 4b709341be948b88e9a09be1f13c7a3220705004
SHA256: 9b0951859aa3047b2c3490aa37c4efcf951d6a6962d7229b1f2dbe0b8c9887c2
Imphash: c3a0c5143f1397434349cec9c238a304
Vhash: 094066655d16551569z36z3bxz
Authentihash: 0c97d894a6311657684c6c466e0af27d427cd181967f953d3bdbfecf17c8dc01
Rich PE header hash: 4463426c66f5ff5800652ff9f315f61a
SSDEEP: 1536:jBN3330HZysl3JaIGc91J1agd6I0BF+4kHsqscU3sOAEPoiD:jBN3n0HoqMIGc51fd6I0B048sfrAFw
TLSH: T1D0936D23E9062462F9B6AC3265ACF73AE87CAB30071748D3E7C4CA6145505D33B776A7
Signer: 雷神（武汉）信息技术有限公司
Signing date: 2021-03-19 02:42
SpcSpOpusInfo: N/A
VT detections: 17/73
Compilation time: 2021-03-19
PDB path: E:\Code\nfsdk-src-1.6.0.7\driver_wfp\msvc\Win8Release\Win32\lgdcatcher.pdb
Country submitter: Singapore, United Kingdom, United States
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u