N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-03-23 13:26 VT 52/72

Driver Name: N/A
MD5: a55cb8be2887e99b4f662fc1ae08d265
SHA1: c34655bcb240e0db570a02dd7260ac70a0e70075
SHA256: cdf794da1092c4010c2a3350b174e000351e9bf7d791bd703aa137ee86b8ff70
Imphash: 6a4b1bcf05e6e0a2b1cdcf0be207c18e
Vhash: 016086555d15761656651iz5exz
Authentihash: c329815d2b529d26c885702efc8295b3fb04217566c81838e47b81a2c34c96e9
Rich PE header hash: 709a43a3215a26f36f5b63f4c8ce57a6
SSDEEP: 24576:oGOvyRIsvF90/vUB2oRLXWcgLhQGy3buJ/HNmUzpitLKhCD/fn:oGHxvT1zLE2GMbcmEwJD
TLSH: T1FC559D6DE3567398CC2EC4749427B905F2B06E0E03EC5FA6B2CBBB907B97560D14970A
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-03-23 13:26
SpcSpOpusInfo: 沈阳柯基网络科技有限公司
VT detections: 52/72
Compilation time: 2022-03-23
PDB path: D:\VR_设备\vr新1号\x64\Win7Release\KB_VRX_device.pdb
Country submitter: United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.