← Back to malicious drivers

dd23fdb05c78a10acc716ba234925a658f80b45eaca7d08ba045c67ca977827d.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-27 11:10 VT 41/73

Driver Name: dd23fdb05c78a10acc716ba234925a658f80b45eaca7d08ba045c67ca977827d.sys
MD5: b5c73db8e70d6f46ad9b693f3ce060d2
SHA1: ff5ce3b5d4f5cad313aaebdd5885e0a0ca0f3924
SHA256: dd23fdb05c78a10acc716ba234925a658f80b45eaca7d08ba045c67ca977827d
Imphash: 63b6cae92df6bed6826785cc5d2617ff
Vhash: 045086655d151e5e6f7519z17z1xz
Authentihash: ffc58e510d2e2bdfd45e09bed1539c275dec9edca79210228f7b3325d0c0fb17
Rich PE header hash: 9e87c3b4ff4a87d4ce4242e1274bb063
SSDEEP: 12288:f52ir7q/yKWRHGhPYDpRAsY4qUIHuzl9r:fI6qYAADp9Y4qUIHWld
TLSH: T13F949DD2F3810CD7E31AAE7D81E96662B930B4A7C724DAEF554441860E5A3E4A43D33F
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-27 11:10
SpcSpOpusInfo: 宁波以安网络科技有限公司
VT detections: 41/73
Compilation time: 2021-04-24
PDB path: N/A
Country submitter: Turkey, Hong Kong, China, NO
Flag: Malicious

Description

Kernel-mode droppers (kernel loaders). Their core function is installing a second-stage kernel driver fetched from the internet as a boot-start service: they write it to system32\drivers\.sys, create a service key with Start = 0 and Group = "System Reserved", then call ZwLoadDriver, retrying every 300 seconds on a download failure and every 180 on a load failure until it succeeds. Alongside this loader core sits a traffic-hijacking layer that rewrites the system proxy configuration and seizes the default browser handler, routing the victim’s web traffic through attacker-controlled infrastructure.

IOC: hxxp://wx.weixin6677[.]top:6677/drule