5n4Bw2k5lsv.sys
- Driver Name
5n4Bw2k5lsv.sys- MD5
63960dbc7d63767edb6e1e2dc6f0707b- SHA1
1ca51f22854600ece6afc17caaa2a5eafda0c58f- SHA256
cce24ebdd344c8184dbaa0a0c4a65c7d952a11f6608fe23d562a4d1178915eac- Imphash
633c885f57ccee60fa69445dea1892b7- Vhash
016096555d55761656651iz57xz- Authentihash
14a60b19797c5b1a205c1a49a3fe5bd2608307ef91db55b08680f8e2a0821995- Rich PE header hash
49efdb57a690b47c35210027f9cb225c- SSDEEP
49152:9Yl91pOqvIG8UvWHcjbio3FGL/c5pqAwU6XINXgH:9W+/tyfjbN10/c57v0- TLSH
T138857C65E3132294CC75C4B4A53A7917B4323E1983AD0FF7E389BBA0675E5D0A279F08- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-07-28 13:05- SpcSpOpusInfo
福建奥创互娱科技有限公司- VT detections
43/70- Compilation time
2021-07-28- PDB path
E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb- Country submitter
- China, YE, South Korea, France
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz