9bfa994918b76bcbf7b225b2f94f8e961982caf3b5bc0d1dcb683b40e4549a54.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-23 13:26 VT 41/73

Driver Name: 9bfa994918b76bcbf7b225b2f94f8e961982caf3b5bc0d1dcb683b40e4549a54.sys
MD5: 232b0156173a9f8f5db6b65aa91e923b
SHA1: e418b666d73deabfe1d7361737f49620e39be615
SHA256: 9bfa994918b76bcbf7b225b2f94f8e961982caf3b5bc0d1dcb683b40e4549a54
Imphash: 6a4b1bcf05e6e0a2b1cdcf0be207c18e
Vhash: 016086555d15761656651iz5exz
Authentihash: f3601b78832aaaabc925b63532abdb469b9677ca1f41efabc090de41c4d28a82
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:oGOvyRIsvF90/vUB2oRLXWcgLhQGy3buJ/H4mUzpitLKhCD/fn:oGHxvT1zLE2GMbRmEwJD
TLSH: T137559D6DE3567398CC2EC4749427B905F2B06E0E03EC5FA6B2CBBB907B97560D14970A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-23 13:26
SpcSpOpusInfo: 沈阳柯基网络科技有限公司
VT detections: 41/73
Compilation time: 2022-03-23
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: Turkey, United Kingdom, Canada, China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.