f7762e6be7deb42bc7053c40c9af0d3b.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-20 06:37 VT 43/74

Driver Name: f7762e6be7deb42bc7053c40c9af0d3b.virus
MD5: f7762e6be7deb42bc7053c40c9af0d3b
SHA1: b6a146655003fd8f6f40f51f06be80f5b8db1981
SHA256: d73ab98c64293ae8da8d8112cb029988cc15ac2f7a0e7be6b08f410c828a92d0
Imphash: 4e97d36152e8092401db2cdcda243920
Vhash: 016086555d55761656651iz62xz
Authentihash: c0d3dc877bd9436d599e16fa2a2bf8276061799fa19af19abb9f5ebdff081623
Rich PE header hash: 76aaf95953c5083ec69cf532d964cb4f
SSDEEP: 24576:hTcp848egRZ0ZAN84Owjl+qOcqeUn6kIHc6B0ebpAUABz/T+gui49pkws:k84eTBlThkm3BFe7Bz7B4Lk3
TLSH: T1F9955A55E3135298CC75C0B0A97A3913A4327D28C3AD1FF6E395AFA0A74E5D0A27EF44
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-20 06:37
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 43/74
Compilation time: 2021-07-20
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: Canada
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz