b76b6108dbf008e3676c296c14f86edd.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-06-15 03:45 VT 37/72

Driver Name: b76b6108dbf008e3676c296c14f86edd.virus
MD5: b76b6108dbf008e3676c296c14f86edd
SHA1: 4dde14abea667f00c2ae0e1362fba3efdd512904
SHA256: e1b2088626c8795c58e04be6b8ab15a4a792602c6d22eacb090cd42c495c6086
Imphash: 633c885f57ccee60fa69445dea1892b7
Vhash: 016086555d55761656651iz57xz
Authentihash: 2c5f8691543a3dce3c0780888e8b34f55e51ecc485b872cb6f97cda6b994df12
Rich PE header hash: 7a636910d32765bace1b0b2740e20351
SSDEEP: 49152:OelYpOqW8knigOJnGfhnQ+KxP2oIxbGwgLIIEu4A7K2zqPiCLFO0HIrSiSh:OSvaGWHfPoHH
TLSH: T159857B59E3132398CC65C0F4947A7917B4722E2983ED1FE6E399BBE0A74E1D46239F04
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-06-15 03:45
SpcSpOpusInfo: 海南巨灵网络科技有限公司
VT detections: 37/72
Compilation time: 2021-06-15
PDB path: E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb
Country submitter: Canada
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz