vpn.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-02-15 06:07 VT 39/72

Driver Name: vpn.sys
MD5: cc29cf2294175315acbf33054151f3cd
SHA1: 52060d5059375e3d743fb3aee9eaa866f6b6eb4f
SHA256: a9b386e1d522afae0c88c6390b912bdde30786c05fb8dec08c271200d25419ed
Imphash: 6663243007db0e0257030c153f75303b
Vhash: 016096555d15766656651iz79xz
Authentihash: efbe00492f0251b28d4064d4f32b565125028fe7b6c7dcb685f38d97fc96f461
Rich PE header hash: 26475e631a56bf9d887918ad79870da8
SSDEEP: 24576:zpcAccg7MhQIGYHVo8KpIWBu8xmiyFoikIoaBeK5fIoagvTeCgneS:CAOmQIGYHVSPBcouJ5AJG8eS
TLSH: T17D559C5DD34B7398CC2EC4B05427B806F2B06E0D47EC6FBAB2DBABD0A796560E509705
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-02-15 06:07
SpcSpOpusInfo: 厦门恒信卓越网络科技有限公司
VT detections: 39/72
Compilation time: 2022-02-15
PDB path: D:\speeder\核心驱动\master\x64\Release\wfp_vpn.pdb
Country submitter: Italy, India
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.