EB486D6FBC6886E3370386438C52111283524CD95ABD629ADCD55EC7C9ADB706.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-07-20 06:43 VT 47/73

Driver Name: EB486D6FBC6886E3370386438C52111283524CD95ABD629ADCD55EC7C9ADB706.sys
MD5: ea5f6ab5666193f805d13a49009f0699
SHA1: 6f2baa137a43108cad1711d439b5bec25533a03a
SHA256: eb486d6fbc6886e3370386438c52111283524cd95abd629adcd55ec7c9adb706
Imphash: 4e97d36152e8092401db2cdcda243920
Vhash: 016086555d55761656651iz62xz
Authentihash: e8ac5976bb0a68c1ce3d05b54e5d072a2a244d5b4e6c532d462b1852eb869ffe
Rich PE header hash: 76aaf95953c5083ec69cf532d964cb4f
SSDEEP: 24576:ZTcp848F9RZ0ZAD84OwOEfYkGIuhf79SJ4Jf3LJjQhjDn6E/XY28l8r/K7E8nFHo:884iT6EgkGI4Q457lQhjD6uX7r/Onto
TLSH: T170956B25E3136294CC75C0B0A97A3913E5717D18C3AC5FF6E394AFA0A65E6D0A27DF08
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-07-20 06:43
SpcSpOpusInfo: 福建奥创互娱科技有限公司
VT detections: 47/73
Compilation time: 2021-07-20
PDB path: E:\巨灵驱动源码\PacSys\x64\Debug\Pac.pdb
Country submitter: France, China, Canada
Flag: Malicious

Description

FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.

The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.

IOCs

zkrf8ar[.]xyz