netdlx64.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-10-26 13:50 VT 25/72

Driver Name: netdlx64.sys
MD5: b170fab6906eb4bc9873066d3b1ac69a
SHA1: 03a57a9bfa5ffb6796366d7ee9ed39060fc5318f
SHA256: ac31c2b6eb5eaa1f2e5e808698ff0193f2a226513fe31e9042b06f77b47e1ddc
Imphash: dd40f5b51f0c60504774fe5ba71e8a7b
Vhash: 126086050d050e06077519z17z1xz
Authentihash: 6b7811e1e96716c339100a13cdd91d69b4be07059625996074ad9ee74801515e
Rich PE header hash: N/A
SSDEEP: 49152:zvdY+2fqcdpC0eAJNK6sqFvuGg9q9XlEJ6hWQgm8WmFskFOdNLm5P61mHBP0gmcn:zvW+7cPKjqFWGxXM/B29mh8on
TLSH: T1A0D5F1FE62543318C41ECD349137AD48F2B6402E1BF8956AB6DB76C0BF67811EA16F09
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-10-26 13:50
SpcSpOpusInfo: 广州极智信息科技有限公司
VT detections: 25/72
Compilation time: 2021-10-25
PDB path: N/A
Country submitter: Germany
Flag: Malicious

Description

kernel loader that download a second stage kernel driver and loads it.

IOC:

hxxp://walmartupdates[.]com:13238/auth7.bin

hxxp://exxonupdates[.]com:13238/auth.bin

hxxp://exxonupdates[.]com:13238/auth7.bin