b38e92fb1db29c4b4bfe21f51e87d8bdb6647251037b333505c4641bb2255ce9.sys
- Driver Name
b38e92fb1db29c4b4bfe21f51e87d8bdb6647251037b333505c4641bb2255ce9.sys- MD5
e6960ae657786979493da1786191bcf4- SHA1
1d9b72b4ac7a1d086173fc4ba950c8df030966bd- SHA256
b38e92fb1db29c4b4bfe21f51e87d8bdb6647251037b333505c4641bb2255ce9- Imphash
ab7801caf39f7703a52354de80bb983f- Vhash
035086555d65561655151iz66xz- Authentihash
6fd92aa3a3e7c346fc952539b4da45dced346c10b2c81ead95deb0c9d3e82e1d- Rich PE header hash
1c1ded6dcb968ef382de2faa98c2c729- SSDEEP
6144:KBjMy0ot3U8i+ocl2YRjCkC+J2KuIQtKtAE:0AUt3UaoclRjkhKBLb- TLSH
T1CB641947E6AA10F5D8B6D0748593722BFA703C5583309BDB97904A271F237E0AD3E798- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2020-11-11 08:06- SpcSpOpusInfo
Shanghai Fangye Network Technology Co., Ltd.- VT detections
28/70- Compilation time
2020-11-11- PDB path
D:\Projects\源码\ColdProtect\x64\Debug\Fsfilter264.pdb- Country submitter
- Italy, Russia
- Flag
- Malicious
Description
A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.
Indicators of Compromise:
C2 IPs: 45.248.8[.]212, 103.88.32[.]122, 103.85.86[.]3, 103.60.165[.]145, 110.42.9[.]59, 27.124.40[.]169
C2 ports: TCP 2025, 2136, 2247, 2389, 2467, 2598, 2673, 2781, 2859, 2962
C2 paths: /api/system/getSystemInfo, /api/safe/downfilelist, /driverfile/
Proxy URLs: hxxp://hxtai.mirpac[.]com/api/pac/pacReback.html?key=10073, hxxp://moren.mirpac[.]com/t.txt
Device: \Device\MyDevice264 (symlink MyDriver264)
Marker files: c:\juling.console, c:\config.pac