vpn.sys
- Driver Name
vpn.sys- MD5
6e730cf4ebcd166d26414378cab3a6d8- SHA1
575a56fb957f51dc69b73e7ce157245395e4b0de- SHA256
e2579e7d5038c3ad71b4683e11732734d6c217b44b1c1be94f2bbdeb071b1448- Imphash
c4110de9fddcb44c9133bf3e705b09c7- Vhash
016096555d15766656651iz7cxz- Authentihash
c9ecf147554aecf8c2e9ff965b8d56ffc8034de78453ad2c376996eaec0ff253- Rich PE header hash
2727c7cde3e2a5cb12fb6e08c10ff5f2- SSDEEP
24576:4NfFrQybR9D2eS8dijt2H/nWYoblK3NrATpZuFTzJZ36b9F0D:4NfKy3KTjWWRbl0ZEpZuFb3sGD- TLSH
T18355AEF9D34273D8CC2A88349123F846F2B42D0D43AD5FFABBD6B7A07B265209155B49- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2022-02-18 06:58- SpcSpOpusInfo
厦门恒信卓越网络科技有限公司- VT detections
41/73- Compilation time
2022-02-14- PDB path
D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb- Country submitter
- Malaysia, France, China
- Flag
- Malicious
Description
A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.