c823ed1e83337cddb9e43409ed92681590b6d2a251058b221734864233878c92.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-29 19:21 VT 37/72

Driver Name: c823ed1e83337cddb9e43409ed92681590b6d2a251058b221734864233878c92.sys
MD5: 5d1cb0589fbcc59a70fd014f66bbacad
SHA1: 67e13bb9d32d9bec0479e5d44b96928c503dc5a3
SHA256: c823ed1e83337cddb9e43409ed92681590b6d2a251058b221734864233878c92
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 4358398a0fb817ca7791027d27a2b83c7d5d2e1a52eeb98dc9b78a6e7bbb2798
Rich PE header hash: N/A
SSDEEP: 49152:WsvkDKF4S45cq6AujML9SCsIiyLDkyEKzjrVJQ43EWCN9rJ1aYVBBAFjvD+Ok0nB:ZvwR8oSvF6XEQjrVJQYjIJowDd0
TLSH: T12B0602FC6290736CC01EC960A133FD44E1B5565E0EE9D5FE76D7B6C07BAB810A606B0A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-29 19:21
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 37/72
Compilation time: 2022-12-29
PDB path: N/A
Country submitter: Taiwan, China, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.