N/A
- Driver Name
N/A- MD5
5fff782c54555dab091267635f4cdc90- SHA1
a76768bde060a1cd2096c9b06b945b65b7fc56af- SHA256
bebba608fd3dee6d0142631c3fb7399511fc65618aac2228db2efe83c39d4859- Imphash
c8bf7acf6497b76ad58721e796f9a882- Vhash
015076655d655616551iz55xz- Authentihash
afed8950879036ca03fb4ea5da881f7e019515b2f6896e5d8ed59144eab4bdd3- Rich PE header hash
60d68ccf8f859bb3239ac7db34c3506a- SSDEEP
3072:Lv2CUOSxYFZ/eKTzB0IizjQO9bJ/oMMOvOpqqRJps5:LvKOSUZzzWYOtJQMMO2pqqRJ65- TLSH
T12C042801F39382E4DD6785B4CA4A600BD2707C05A33D9FAACF92BA745F33B81E569257- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2023-02-22 03:36- SpcSpOpusInfo
海南企凡科技有限公司- VT detections
36/73- Compilation time
2023-02-17- PDB path
D:\驱动源码\LB\pt\x64\Release\1f5a426d.pdb- Country submitter
- China, United States, Germany
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.