2ddec3b9a96665fb74e2f9bc9cad5e30.bin

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-05-15 09:38 VT 42/72

Driver Name: 2ddec3b9a96665fb74e2f9bc9cad5e30.bin
MD5: 2ddec3b9a96665fb74e2f9bc9cad5e30
SHA1: c9b75f2c62155d45e6745caf3d9d87cb2d5549e2
SHA256: b7516dca419d087ef844c42e061a834908f34e7363577ab128094973896222c8
Imphash: d252001e327cf09463aba69fb4de2125
Vhash: 054066651d1516551iz5yz
Authentihash: dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc
Rich PE header hash: 85bc198af7e82d3ad73505bc7086be84
SSDEEP: 768:F1ZqCQKy8IYdfWiUelR36ihR6nmRYs1SHjS/OPNi7GbRul:FNyq+4lRX6IH1SyOVi7ARul
TLSH: T10A438D95A6A914D9CAA7D1B4C262A61BFBF17452232183CF03B1C5950F733E0EF3A391
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-05-15 09:38
SpcSpOpusInfo: Globalsign 中国
VT detections: 42/72
Compilation time: 2021-05-15
PDB path: G:\源码\hello\x64\Release\netfilterdrv.pdb
Country submitter: Germany, France
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u