ccvc
- Driver Name
ccvc- MD5
19d14bf80b3dc4e5b774b362f079a102- SHA1
48eb78aaf0a8083a8948b8c49bce7c2163a0757a- SHA256
ba5a21cb29db8e63a9936e563fcd023e303c44d64efbdb2d27901ad41e444251- Imphash
a29c052d6d153a5736168fa3994167ae- Vhash
016086555d55761656651iz64xz- Authentihash
0f56db40dbdced9078e04619e5d27b74cfec369378d66fab66af9a6af4e68834- Rich PE header hash
b3fc885f5d0ef16f298ee2ff24ed3770- SSDEEP
49152:rhlOa6pOq1vqMMl+Z2WsDVoHFM6jFENO/0C2:9capMqMMl0s54FCu0- TLSH
T12D857C55E31362A8CC71C0B0A57A7917E5B27D1883EC4FE3E396AFA0671E5D0A139F48- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-06-22 06:54- SpcSpOpusInfo
海南巨灵网络科技有限公司- VT detections
49/73- Compilation time
2021-06-22- PDB path
E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb- Country submitter
- France, India
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz