18f71fc3.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 06:09 VT 42/73

Driver Name: 18f71fc3.sys
MD5: d60e235b769cadbc7e83090b79b73ed3
SHA1: 69d4b523ddbe45fed4b0444c36ff76880bbf8891
SHA256: b4f880fab9688519e8ca362df961d5223b19cde913d6874632b20ba58c69e4ba
Imphash: 467798d7c212fab82a6681f61778d791
Vhash: 016086655d15761656651iz6yz
Authentihash: e836e0c80f972d3f0deca7165512296fa3752b5c039b7147bbbea08025330d8d
Rich PE header hash: 8b68754fc2ef581f2f15b37a4d741936
SSDEEP: 24576:iGAlWdexVcO+0l7Wq7uwXbkH1PcBpgXl4VGMQmL9mQCcmGegt271Rc1:iG0Wd8RiwXw1PcBfE/mzvexC
TLSH: T1EE55BF9E72443368C41FC4349133AD06F2F2352E0BE4DAEBB7DBA6D03B6A994D515B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 06:09
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-06-30
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: France
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.