e0c45a26ddf093a462cdd1e6825c601d1643c6ef5fd0c19f6786f95cd01ee2be.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 43/73

Driver Name: e0c45a26ddf093a462cdd1e6825c601d1643c6ef5fd0c19f6786f95cd01ee2be.sys
MD5: cd4b6d8bb762c2281c9b1142588ede4c
SHA1: 798311c2068c6feb5d2a9c81a081c3109e3dab84
SHA256: e0c45a26ddf093a462cdd1e6825c601d1643c6ef5fd0c19f6786f95cd01ee2be
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 22b2467f55df841e7848a718ebcd30b888e47dd4a0ce9dd3345a2fb4b45a8225
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:il3i3wTggcQ8pDE3LOgwLIIjUcCUesWyLAKia5bnYmftY:il3AGvcKpwLI4MSiaTVY
TLSH: T137658D59E35773E8CC5AC0789437F806F2712E0E43EC5FF7B2CAAB90676629091A5706
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 43/73
Compilation time: 2022-06-30
PDB path: D:\投影仪\重定向 -2022-6-23封板\x64\Win7Release\Projector_device.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.