vpn.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-02-14 12:25 VT 47/71

Driver Name: vpn.sys
MD5: bf13a2f4e2deb62b7dee98a012e94d61
SHA1: 74d76146ad3dcf29d1625ec750c492f4aafd4e38
SHA256: 9f4c6a32cc8a5d38f70002c0b9cfc260e3555b1090aee205dd377de434b26d6a
Imphash: c4110de9fddcb44c9133bf3e705b09c7
Vhash: 016096555d15766656651iz7cxz
Authentihash: 9a6b75899d0990ed064f4dfcc58c4a8ab65ecd5ca8c18c29ed07de97b280c6a0
Rich PE header hash: 2727c7cde3e2a5cb12fb6e08c10ff5f2
SSDEEP: 24576:kNPvsOPBjsji/8epZYym88lCKMvfOsgPDsTBbbjSJduLsyx3IeqOEI+QlhwMF9H:kNcO1sjutQc9C8fjSJdOsheqN1shwm
TLSH: T10A55ADF9E343625CCC2A8830C5277446E1B56A0D46BE4FBAB3E3EBF06B17970E515A05
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-02-14 12:25
SpcSpOpusInfo: 厦门恒信卓越网络科技有限公司
VT detections: 47/71
Compilation time: 2022-02-14
PDB path: D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb
Country submitter: Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.