← Back to malicious drivers

x64.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-05-03 05:50 VT 28/72

Driver Name: x64.sys
MD5: 0cd6be3cd9f8a841c06512488496fe0f
SHA1: a8a95bd027ee180a5bdaae35bc96aacd3286d953
SHA256: acb204289d90252bf8ee5c17e4fadac6d1959ef963c26520ba20dd20d50e979d
Imphash: b3d2c4de5a0a1fd4bd036039272944e0
Vhash: 045086655d155e5e6f7519z17z1xz
Authentihash: 3b83694706f71d63bfece77a528094901db6d979446c8d8488dc219035000e79
Rich PE header hash: 9e87c3b4ff4a87d4ce4242e1274bb063
SSDEEP: 6144:gmkVF6rl3QpVVlV+/sU33clQSxP0XRY0uSjHYbs7LEE3FfU3Q/N1IU:gJ6ryI/P3c/P0XRY0uKY2DNU3Qp
TLSH: T1FC948DD2F3C408D7E31AAEB881DA6B61B530B4B3D328DAEB554452464E653E4983C73E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-05-03 05:50
SpcSpOpusInfo: 宁波以安网络科技有限公司
VT detections: 28/72
Compilation time: 2021-05-02
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

Kernel-mode droppers (kernel loaders). Their core function is installing a second-stage kernel driver fetched from the internet as a boot-start service: they write it to system32\drivers\.sys, create a service key with Start = 0 and Group = "System Reserved", then call ZwLoadDriver, retrying every 300 seconds on a download failure and every 180 on a load failure until it succeeds. Alongside this loader core sits a traffic-hijacking layer that rewrites the system proxy configuration and seizes the default browser handler, routing the victim’s web traffic through attacker-controlled infrastructure.

IOC: hxxp://wx.weixin6677[.]top:6677/drule