netdlx64.sys

Malicious 迷南文化传媒（上海）有限公司 2021-10-11 02:46 VT 19/74

Driver Name: netdlx64.sys
MD5: c9139cfb748379e9eac4226412692cb8
SHA1: 8adb5c99f9a4104be80c9c022fefed104f302ceb
SHA256: c5193f9949711b1e1a648274f1368219235e216d4fee6f863e2d21ff10fbcac4
Imphash: dd40f5b51f0c60504774fe5ba71e8a7b
Vhash: 126086050d050e06077519z17z1xz
Authentihash: 5e9dcf897a81482f1dc87275aee9b72b1cdb1b503b54606607e3f4cbd2fee22d
Rich PE header hash: N/A
SSDEEP: 49152:BO9m608h48et7FWZbXudlYd1yj/5EgAjjAF27091ldqDzorv01l59qXo6zqi+tGT:PZ8e1FW1Xudxj/0zwK5Fu3rdvj
TLSH: T1CDD5F17D2288334CC01E88305527AD85F1B6551E4EF9D9BAB2D7FAC07BAB811E906F49
Signer: 迷南文化传媒（上海）有限公司
Signing date: 2021-10-11 02:46
SpcSpOpusInfo: N/A
VT detections: 19/74
Compilation time: 2021-10-11
PDB path: N/A
Country submitter: N/A
Flag: Malicious

Description

kernel loader that download a second stage kernel driver and loads it.

IOC:

hxxp://beboupdates.com:14238/auth.bin

hxxp://beboupdates.com:14238/auth7.bin

hxxp://meeboupdates.com:14238/auth.bin

hxxp://meeboupdates.com:14238/auth7.bin