c765bfde9e4f8e318228b4a8ef231786.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-28 07:25 VT 28/73

Driver Name: c765bfde9e4f8e318228b4a8ef231786.virus
MD5: c765bfde9e4f8e318228b4a8ef231786
SHA1: 92371c06b147d563ebc13b3207369e1ca0ce8356
SHA256: bdc3cea76bfad55d27acb73a807de5e998b03c319a035eafb42380892b5e2559
Imphash: b1865abddb6c5311c70e061e2caef8db
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 7b601dd663b51361e31cce19f406d5bdf48c20310d50a0813f7dee9e6434c616
Rich PE header hash: N/A
SSDEEP: 98304:lkOcYWrhqYhKjmL+30bykMQdWtAhHsrWa:vcYUhq4ImyjkMQdP0Wa
TLSH: T162F501FD628837ACC45B8878D433EE49B276161E47F9D1AE71DE36C07BAB410E641B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-28 07:25
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 28/73
Compilation time: 2022-12-28
PDB path: N/A
Country submitter: CZ, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.