N/A

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-12-27 10:29 VT 28/72

Driver Name: N/A
MD5: 339273e67d7be944990bcbce422cfca5
SHA1: cf9cea2a7237ef371b313f3f9bfff9e5b472040f
SHA256: eb9bfac2fbd500a9dca71b4ca97536fe3f76bc225bb42e95e97a3db0b7687fd5
Imphash: b1865abddb6c5311c70e061e2caef8db
Vhash: 0360a6050d050606060d19z17z1xz
Authentihash: 047075035ac9f797a4afe9f91579513b1585ffb1023ab6b9616d5d08d6bda722
Rich PE header hash: N/A
SSDEEP: 49152:JmNUpcrDHsUFYJGgKb0T84K8Iela5Lkx2s/Zc4PuyV4RzGP6MPvbr2i4Few6M9J:l3UFYJMb0T8cIHLQZHPjRPx7ts9J
TLSH: T1CAF501ED21443218C42F8438D433BD58F0B2562E4EEA95BEB6DBBAD0776E911DA41F07
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-12-27 10:29
SpcSpOpusInfo: 厦门絮飘科技有限公司
VT detections: 28/72
Compilation time: 2022-12-27
PDB path: N/A
Country submitter: United States
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.