984610a8.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 10:54 VT 41/73

Driver Name: 984610a8.sys
MD5: 787782e0395b3d5e32cda6fdea2faba0
SHA1: cb5f7ac02b9301f1816967a81fa57b96466d0fcc
SHA256: e307c96acb9e896650a89d79e42d541bd01e4f5594cab69c971746bf636a3cbc
Imphash: b347363cc4af0547e8fd5638e6b23742
Vhash: 016086655d15761656651iz6yz
Authentihash: 68eb20273088ea026baed7cf0c4c0937633e0880cfe19f4157d59107618aa475
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:QKgwuPrcLcKCNnkFY9u30k+PlW2k+stkcvFEDCqPBqC/JbQZCJy:QKlMciBkYbPLk+ZYEeqZHNQZx
TLSH: T14455BFF96240221CC41AC5309523B949F1B5621E0BED8AEBF7E7B7D02FA75A0E535F06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 10:54
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 41/73
Compilation time: 2022-06-30
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: United Kingdom, Hong Kong, China, United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.