9f097877.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 43/73

Driver Name: 9f097877.sys
MD5: bd3fae4ceb0cfc0d41fb12a940d82a1a
SHA1: 6cae38f0027691795d3185c4d3a5d7102eeb5f96
SHA256: c9697041b8a63bef4239cf3174b63cae1ed5ecf199f49920c6d44fcc6ab30aa8
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 9aaeffd35a49d65ddba49e1dcda8d69347b8717091d0301f48914ec832f3dffe
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:wl3I3wWyfOxQYx6Xa/83w3JrFMDv6UG2qkWd1cJtTqHIcQUrhNiLY/oqMSSnrHnx:wl36im2jO83w3JrCDY2Nc1gTqHpQU7il
TLSH: T1D065AE69E35633A8CC1A88744127B946F2702A0E43FC4FFBB6D677907B67290E17570A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 43/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.