82c4b0ad.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-01-06 02:29 VT 41/72

Driver Name: 82c4b0ad.sys
MD5: 0ed494e67f6c040868f5dce3920a04d0
SHA1: 178f1046eeaa5c9da97aaeeb074dc37e70e95bf1
SHA256: c24e5ddb4bafca38510ffeb882eb7117f8c24b7801292022e1908d4c85579723
Imphash: 48f439d032750c22223613837bd0e50d
Vhash: 016096551d65761656651iz4bxz
Authentihash: 516a1802b5513653ec61cff7105dc0e4e6aa48d11aae35191b1df0d49f4a35f9
Rich PE header hash: 11a1a09d106315db1dfafb60ef2a5f1d
SSDEEP: 24576:JUkyhoPfv7z62XUSRY0Pon5bkJ5By7quUUb2zDLap1QP39fww:JP8QvbJa0au5Bcqp7nmp1QPh
TLSH: T1C155BF9A629433ACC02EC074C823B915F2F5711D0BB59BEB72D7FEC12B679A0D915B02
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-01-06 02:29
SpcSpOpusInfo: Shanghai Fangye Network Technology Co., Ltd.
VT detections: 41/72
Compilation time: 2021-01-05
PDB path: E:\ColdProtect-2\x64\Debug\Fsfilter264.pdb
Country submitter: China
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.