vpn.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-01-13 12:00 VT 31/73

Driver Name: vpn.sys
MD5: 45be5c0e7dfe37f88f1fa6c2fbb462c5
SHA1: 2c6bfa61508563359bf71848261387069fa3d685
SHA256: e542b5f2e57347871a8a602a02208a3287225a4db28ce652b1ebafdce0a0d5a7
Imphash: c35b40d9665d41e5a4e2750abcd53642
Vhash: 016096655d15666656651iz46xz
Authentihash: 20caef98336beaf0f877a3ad4853fe9667ce3c5e2d7b3a09252212570b745650
Rich PE header hash: 1360b2f4fb01ce65dbceb23dd9cfef2d
SSDEEP: 24576:TtQBAApHe5bl2+94/czX5R3gAxiZx9KONod8xe2:TGBjpHefW0rILNNsie2
TLSH: T12035BFE8528C331CC45684309123BE59F2B6920E53D5C9A675E7FFE03BBA875E601B4B
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-01-13 12:00
SpcSpOpusInfo: 厦门恒信卓越网络科技有限公司
VT detections: 31/73
Compilation time: 2022-01-13
PDB path: D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.