f243a7afa1504c340a1b27e1bf8b5f37.virus
- Driver Name
f243a7afa1504c340a1b27e1bf8b5f37.virus- MD5
f243a7afa1504c340a1b27e1bf8b5f37- SHA1
0cde886e0e2ea153c0e3e39400a575ed8a8777df- SHA256
b2435d47ab2c5aa22530371ed3e2864faf486f3d67faf5b420daa7671a686d1a- Imphash
633c885f57ccee60fa69445dea1892b7- Vhash
016086555d55761656651iz57xz- Authentihash
e9200f9466f4e10dab4987f469797be18660573d19f495c58781180ee6937335- Rich PE header hash
7a636910d32765bace1b0b2740e20351- SSDEEP
49152:XecjpOq4BxEyWyhWOhTulmC3HRrtHJvCvfm:XHMF++AOlulmCVq3m- TLSH
T126857DA9E3136254CC69C4F0A57A3D17A5313D2883EC5FF7A385BBA0A75E5D06239F08- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-06-15 03:45- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
37/73- Compilation time
2021-06-15- PDB path
E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb- Country submitter
- Canada
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz