7b6e3fe75c5ae68d7d5a3ae7b00097e0_bf84f41461.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-05-29 05:17 VT 45/73

Driver Name: 7b6e3fe75c5ae68d7d5a3ae7b00097e0_bf84f41461.sys
MD5: 7b6e3fe75c5ae68d7d5a3ae7b00097e0
SHA1: 84de562fd5127684b5a4794ea9947adced745674
SHA256: a1057390e497f45c33145227514c1d7113c550693bd083c58b67083ac432dd82
Imphash: 95f22d6780b9bb23cae4c9010257ba25
Vhash: 016086655d15761656651iz5dxz
Authentihash: 40cc2b6fd5ff40eecd3cb308c5de449360445cbb9becf523edbb7e6b09ac8590
Rich PE header hash: 8f4289d0dc5645cc77d887b2fe464134
SSDEEP: 24576:6TQh1Zoz0yWmSggrpIQfyB6I48HU2AoK3ZOIMBR29lylACyiU0KDtm:QQtozSmcr3AzYoUMBR29L4U0GA
TLSH: T10955CFAE61883368C41EC5709523ED09F3B5262E4BF869FF76C776807B9F490D625B02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-05-29 05:17
SpcSpOpusInfo: 厦门沁云网络科技有限公司
VT detections: 45/73
Compilation time: 2022-05-28
PDB path: D:\投影仪\ProjectorSys\x64\Win7Release\Projector_device.pdb
Country submitter: Hong Kong, China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.