tsocketo.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2023-01-12 06:38 VT 40/73

Driver Name: tsocketo.sys
MD5: 28327174a99bce4f96e8f803b61c7cc3
SHA1: 632a7076472987a185d9403d8e4b30ca12e1f99a
SHA256: ce9290402dad225c3d374ecb654f6fd81033471ef29dcfd9cfa17680bbef6164
Imphash: e187f115e5c86c5ca3b5ea3ea8339b1a
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 69bbb31f8de7d9694731f268952c72daea8d8c1878b30ae1d8ab5f37c1125f7e
Rich PE header hash: N/A
SSDEEP: 49152:m3zQQQkVQCJEz9pqGf9HAQrT4TjCflbDU3wDupKfMDaLf1g7gpFU4pQzNYP7EGhd:mcQ0zmAVX4TjCdE3wQGLzXQ+NQ2b
TLSH: T1CBF501FE6258735CC01EC8245833FD09B3B6552E13E5A5EA7ACFFEC06B6B4149906B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2023-01-12 06:38
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 40/73
Compilation time: 2023-01-12
PDB path: N/A
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.