netfilter.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-05-16 05:54 VT 47/71

Driver Name: netfilter.sys
MD5: 530f12f8058199964d0b41f1856185ec
SHA1: 8b04023990d18dcd5cc4c5538b332b017f3962fc
SHA256: bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a
Imphash: d252001e327cf09463aba69fb4de2125
Vhash: 054066651d1516551iz5yz
Authentihash: c56536f99207915e5a1f7d4f014ab942bd820e64ff7f371ad0462ef26ed27242
Rich PE header hash: 85bc198af7e82d3ad73505bc7086be84
SSDEEP: 768:01ZqCQKy8IYdfWiUelR36ihR6nmRYsn5jS/OPNi7SbpG:0Nyq+4lRX6IHnsOVi7so
TLSH: T190438E95A6A814D9CA77E1B4C266AA1BFBF17452232183CF0371C5950F633E0EF3A781
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-05-16 05:54
SpcSpOpusInfo: Globalsign 中国
VT detections: 47/71
Compilation time: 2021-05-15
PDB path: G:\源码\hello\x64\Release\netfilterdrv.pdb
Country submitter: Poland, France, United States
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u