c2b051d4be9deed56d51a3579868f76022d91d14511fc84eb51749fc225d8121.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-09-09 13:42 VT 37/73

Driver Name: c2b051d4be9deed56d51a3579868f76022d91d14511fc84eb51749fc225d8121.sys
MD5: a54ef0a7a31d0e3fbc56f05c610bb694
SHA1: 02ad7187ddec47f720d9cd380040ffc48b74f6d9
SHA256: c2b051d4be9deed56d51a3579868f76022d91d14511fc84eb51749fc225d8121
Imphash: 26657703ef97fd050161aae9690705dc
Vhash: 034066651d151e551iz2fxz
Authentihash: f44c6aaa29d45f8c3e2e19c1721e2564a5365300251dc16387bf2eae0cf880ed
Rich PE header hash: 5c5035d4790443e94fbc16c2a8532001
SSDEEP: 384:rpI+aIZlcE8jzl0cp0/gY6C1sVxFhm6sCXY0HEBjzDskFEXRZuLh3RF4qslGsETb:r6slc1jx0cpR1LIEYCCV2St3RNP
TLSH: T192D26C81C26810CAE973D9B9C699D7A7FE30F545A72102DF03A1D8485F53FE2A739750
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-09-09 13:42
SpcSpOpusInfo: 宁波以安网络科技有限公司
VT detections: 37/73
Compilation time: 2021-09-08
PDB path: N/A
Country submitter: Turkey, Germany, South Korea, China
Flag: Malicious

Description

Kernel-mode droppers (kernel loaders). Their core function is installing a second-stage kernel driver fetched from the internet as a boot-start service: they write it to system32\drivers\.sys, create a service key with Start = 0 and Group = "System Reserved", then call ZwLoadDriver, retrying every 300 seconds on a download failure and every 180 on a load failure until it succeeds.

IOC: hxxp://divpicture.oss-cn-hangzhou.aliyuncs[.]com/x.jpg