b57e4wgi.exe

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-03-19 13:05 VT 36/72

Driver Name: b57e4wgi.exe
MD5: a9541530619a3ac2615b92603b705fe6
SHA1: 6f1fa0b2e8e5edf22bcccdfb50a441523079b5e9
SHA256: d2f2ae1994b0027dcff8447b74216a6017e426ccc31d169f0e865a9e4f62057d
Imphash: ae14168e71151f57d9acc21992fb9812
Vhash: 016096551d55761656651iz62xz
Authentihash: 7b8354fc431e903e728546842991df784773f29cb9aefb53fe3032b122513b75
Rich PE header hash: 444289698dc0195c99d0e3905b94e916
SSDEEP: 49152:I4M6uu5t4UCDg5xIeXvFbxVJ6eCK9dBGdfGAFearv:I4au5W7D+/bxxChGApz
TLSH: T1CC956B2AD31B62A4CC75C47056273456E2707D0883BC6FF7F3D29BB0BB96790916AB48
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-03-19 13:05
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 36/72
Compilation time: 2021-03-19
PDB path: E:\ColdProtect-1\x64\Debug\Fsfilter264.pdb
Country submitter: France, Canada
Flag: Malicious

Description

A Windows rootkit that loads at boot as a file-system filter driver and cannot be stopped until reboot (no unload function). It protects its own registry key and driver file, redirects browser traffic through an attacker-controlled proxy, and checks in with one of six hard-coded C2 servers every 5–7 seconds to download updates. It also exposes a device (\Device\MyDevice264) that lets user-mode programs kill any process and read, write, or delete files and registry keys with kernel privileges.