9d854494d349ad34544c4667bc00dc13fc8d005fb743875ffba9fdc332806248.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-01-09 09:26 VT 37/72

Driver Name: 9d854494d349ad34544c4667bc00dc13fc8d005fb743875ffba9fdc332806248.sys
MD5: 418a4b8e030cdcde3b21809bd88f75cf
SHA1: 32c18724577a038c108d984476ab931b32378cbf
SHA256: 9d854494d349ad34544c4667bc00dc13fc8d005fb743875ffba9fdc332806248
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: fa9ee87fd5ddc7d88755e7735881c3e24368a9179c786c895672b9249d640333
Rich PE header hash: N/A
SSDEEP: 49152:mpbipn0J6ys6L6OfgpxO7lQiR5kQcaLW4dizbErDEEIttIeZSFwyOLZ9wpe+d:mpbiRG3L5IpxcQ0kQDLdizOEtXKKNKjd
TLSH: T150F502DD21A4336CC01EC1289833ED49B3F6851F07D9EAA9B1DFB780775A861D982F46
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-01-09 09:26
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 37/72
Compilation time: 2023-01-09
PDB path: N/A
Country submitter: United States, Japan, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.