e470ca7bf1c36abc8e2e4a4ee61d8903.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-11 14:47 VT 42/73

Driver Name: e470ca7bf1c36abc8e2e4a4ee61d8903.virus
MD5: e470ca7bf1c36abc8e2e4a4ee61d8903
SHA1: 7da7f8a75ea30444aafa1f2103cb1aa081f5b8b3
SHA256: d537ca0c8cdec4d1fa149c6e53fb19fd2cc02cde1b76426803e51717993a73fc
Imphash: a378ef52536851ec2cf8d59d87ac0d98
Vhash: 016086655d15761656651iz63xz
Authentihash: ec6c134f61e15af9b3f30631c7a435476212357d4956c3ba78f651bc048151c3
Rich PE header hash: 8c4317d2b0a85d863c5a1a44385242b6
SSDEEP: 24576:/61EC5KDlpbtFB1f0+lEswxLotUD7FCaNLXrr0Jd7bgBtQ3qoWiRx/FHdf+:/BrpxtFBJ5lNwZotUD7FCkLXkJdY8aHG
TLSH: T1EB55BFE8724033ACC42AC834D127F809F0F5754E0BA58AF77BD7B6D02F6A5A4D625B46
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-11 14:47
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 42/73
Compilation time: 2022-06-11
PDB path: F:\socket版\重定向 -2022-06-9 线上 - 副本 (2)\x64\Win7Release\Projector_device.pdb
Country submitter: United States, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.