fe4d3123dca2d3c3828bcf733edf9c44.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-18 14:15 VT 48/73

Driver Name: fe4d3123dca2d3c3828bcf733edf9c44.bin
MD5: fe4d3123dca2d3c3828bcf733edf9c44
SHA1: 0dae0508f01052d1d239b7a517ff0bdb09a4c84e
SHA256: 9b55b35284346bbcdc2754e60517e1702f0286770a080ee6ff3e7eed1cab812a
Imphash: 65d30cc87c577993c93cb195d6716808
Vhash: 044066651d1516551iz2exz
Authentihash: fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533
Rich PE header hash: c79a8ee3bcd2804aa39c533a63841b48
SSDEEP: 384:e05bxbIkdpya/hANFEa3ycYdVuPASXuOK75Nq4U1FfyAum5BFoTxSDKb2pY1brPx:e0sakFEaJ8Vrinw5wdyA/O7b2pY1Xb/t
TLSH: T146138C8566A804C6DE3390B4C2A2E607EBF535462351C7DF0B21C9962FA33D0AF3A754
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-18 14:15
SpcSpOpusInfo: Globalsign 中国
VT detections: 48/73
Compilation time: 2021-04-18
PDB path: C:\Users\omen\Desktop\新建文件夹 (4)\x64\Release\netfilterdrv.pdb
Country submitter: Singapore, France
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u