N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-03 13:45 VT 28/69

Driver Name: N/A
MD5: f2982de73a5ced883feda2558d0de036
SHA1: d0fd15211fc5f53003ceb42f760b7bf9c4c8504d
SHA256: cd6f88016a1d62e51bfe19a74f46e2df747fb545b07b77f3a876c4ec14318710
Imphash: 6c1f994d922643f95264f4a0116c547c
Vhash: 115066555d151e151iz4dxz
Authentihash: f87c20208021387215d7be43061acb686cb3c071937a8f3afb5918af92031441
Rich PE header hash: 632239e4ea42038e8b01f41a6df3af38
SSDEEP: 1536:w13GjWdYed9yY/cjzx5oYvsEQKPPBSCzvj51mplYrlXvGw4QGb1h4LhTbfOt51:w1Z+ed9ypjgcoGrNvr4CL9WD1
TLSH: T198C3A652E672D0DBD4B5C1346262727779B27928C324DBD78BC09712AB22BF0A93F744
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-03 13:45
SpcSpOpusInfo: 广州极智信息科技有限公司
VT detections: 28/69
Compilation time: 2021-07-01
PDB path: D:\git\tempobj\rel_x64\drv64\drv.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader with no device and no user-mode interface connects to C2 over HTTP GETs to hxxps://list-1259150075.cos.ap-shanghai.myqcloud[.]com/list.dat. The received drivers are base64-decoded, then AES-128-ECB decrypted with the key 0XMTXKEDTNLDKADS, and installed as Boot Bus Extender services in \Registry\…\Services — timestomped to match acpi.sys and dropped into system32\drivers.