IRkce.sys
- Driver Name
IRkce.sys- MD5
bf53cc218f8a65e03d5edaea03190464- SHA1
0ee94cb5fbfcedee0ab4b17466a658f26f0e023c- SHA256
d2bc376cbd0e6093e6ddbcf3c6fed2dbfb9c093157090815642efbbc0b2fb971- Imphash
6e3395e5a3a9e302a939e7010f9747ef- Vhash
015066551d151e551iz71xz- Authentihash
27cadec0cef8f87ff20377338ca9e44a642b122758bba972375e2b4ea10cf20f- Rich PE header hash
cd08aaaf4c9283d5967d1c2236a759b3- SSDEEP
1536:WGfMUW5i8s6J6IqSynRl8uoLQd8cDq4oATTawJg6Q5LT0RVUfq:Whts6J6IqSyRl4x4oATTtJCmb- TLSH
T19BC3B756F6BB60D4D8F5D0385263B237BDA279184339ABD786418A079B32BE0F93D740- Signer
大连纵梦网络科技有限公司- Signing date
2020-10-12 02:38- SpcSpOpusInfo
N/A- VT detections
32/74- Compilation time
2020-10-12- PDB path
e:\代码\私活\X5\http\TdiFlt_1\TdiFlt\objchk_win7_AMD64\amd64\TdiFlt.pdb- Country submitter
- France
- Flag
- Malicious
Description
TDI network hijacker
• Network filter: Attaches on top of \Device\Tcp, \Device\Udp, and \Device\RawIp, so it sees all TCP/UDP traffic. Its control device is \Device\devTdiFlt (\.\TdiFlt), which any process can open.
• Config download: Once explorer.exe is running, it resolves ew8re7.zzxvz.cn using its own DNS client, trying 8.8.8.8, then 114.114.114.114, then 4.4.4.4. It then downloads /list.txt and /i221.txt over HTTP on TCP 8971.
• Fake redirects (/list.txt): Each line is a rule. When a browser requests a matching host, the driver drops the real request and returns a forged HTTP/1.1 302 Found response pointing to the URL in the rule.
• Kill list (/i221.txt): Any process that connects to one of the listed ip:port pairs is terminated.
• Homepage hijack: When one of 12 browsers starts, it rewrites the browser's command line so it opens the driver's URL. The browsers are iexplore, qqbrowser, liebao, 2345explorer, UCBrowser, 360se, baidubrowser, hao123Juzi, rccb, Maxthon, 2345chrome, and Chrome. The URL is set by IOCTL.
• Self-protection:
o Recreates its driver file if it is deleted.
o Keeps the file open so it cannot be modified.
o Detaches any filter stacked on its devices.
o IOCTLs (12, 0x222000–0x222064): Traffic statistics, blocking processes from the network, adding redirect rules, turning hijacking on or off, and setting the homepage URL.
IOCs
C2 domain ew8re7.zzxvz.[]cn, TCP 8971
C2 URLs hxxp://ew8re7.zzxvz[.]cn:8971/list.txt, hxxp://ew8re7.zzxvz[.]cn:8971/i221.txt