tsocketo1.sys
- Driver Name
tsocketo1.sys- MD5
fa2a58ecd760bab82aa2ed4f0277dc4a- SHA1
ceb5426d67abc5b7a473ab477df20ad8f86656ab- SHA256
a01dc54919fcc0cb6bc4f29b44a86b493bf5bb6ef7641b1a53856e343166af76- Imphash
e187f115e5c86c5ca3b5ea3ea8339b1a- Vhash
0360a6050d050606060d19z17z1xz- Authentihash
10f815283afb113ed28d069c6d5ff9213978063c0dbf30be789cbc5c5efdbc84- Rich PE header hash
N/A- SSDEEP
49152:XGJFd0UVYDUMnpqGKVkVKQq+boQV5I90ox2CwGY8+KlvYJ2+CT4Q74pqGjdo/Hs0:2XjVYQMnk2KQqwVW2oe89YEh7U237yw- TLSH
T1DAF502FD2198331CC41BCC649533AE18F2B6561F13E9E66E76CF76807BAB520D902B49- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2023-01-12 06:38- SpcSpOpusInfo
厦门絮飘科技有限公司- VT detections
36/73- Compilation time
2023-01-12- PDB path
N/A- Country submitter
- China
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.