9EE3F79C53375C4B0D2F181525B7E037CEBF767D6A9ED72A18B01FECB80988D9.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-07-10 10:54 VT 46/73

Driver Name: 9EE3F79C53375C4B0D2F181525B7E037CEBF767D6A9ED72A18B01FECB80988D9.sys
MD5: b7239e06bcbe6e2c7bb2f7a859cbf4f7
SHA1: 538eb6839fd0b6988ac2a3714c8c6fe6e7274a90
SHA256: 9ee3f79c53375c4b0d2f181525b7e037cebf767d6a9ed72a18b01fecb80988d9
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 189122f8d057ceef633e542a682bfaf3ee6129577754e2b954b1f959abc9a7d1
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:1b7+OOXwV/cfhaoMRPzNv2sAxqPthe//8mgTMp76x+Bevl7X1xV2JFgsrvFNQ1aB:1FXtcfozv2sAxq1ha/8Pq6xuc11xVG2O
TLSH: T1CE65BFA9E34233A8CC16C8748523B846F1B02E0E47BC8FF7F7D667E06B565A0D165B49
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-07-10 10:54
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 46/73
Compilation time: 2022-07-09
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: Poland, China, United States, Hong Kong
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.