C3031C86690A2E7B287371DA6D086D41B13C864E1FD3AE961F6A2F5A3532C9FF.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 46/73

Driver Name: C3031C86690A2E7B287371DA6D086D41B13C864E1FD3AE961F6A2F5A3532C9FF.sys
MD5: cb6a416204b57470fab0b944d7b59756
SHA1: 9cd6904920f3eb85ee689252e88e8412382184a5
SHA256: c3031c86690a2e7b287371da6d086d41b13c864e1fd3ae961f6a2f5a3532c9ff
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: b31496e37092ef0630bcc12a2994182f12641e9550c6e20b7809de5ffc0db480
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:7l3e3woFfP2DFyDh+3iCBEkfERXUCa6ZcLy1XyEENLBd91Nv6wKNOesefFk:7l3cnfMYDYukCdaqcL8RENLVioea
TLSH: T1B865BFADE3527398CC1B84348127B806F1B12E0E4BAD4FFBB7D6A7D03B5A590D164B46
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 46/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: China, Hong Kong, Poland, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.