netfilter.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-18 14:39 VT 42/68

Driver Name: netfilter.sys
MD5: a57e4e3a3fa46bbdbc9d803283af3479
SHA1: 4ede7f018c317ddc6a5f8f935f917621668cb1ec
SHA256: f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca
Imphash: d252001e327cf09463aba69fb4de2125
Vhash: 054066651d1516551iz5yz
Authentihash: 0988d366572a57b3015d875b60704517d05115580678e8f2e126f771eda28f7b
Rich PE header hash: 85bc198af7e82d3ad73505bc7086be84
SSDEEP: 768:y1ZqCQKy8IYdfWiUelR36ihR6nmRYs5ZjSyrNi7fb:yNyq+4lRX6IH5vi7T
TLSH: T133437E8666A914E9C967E1B4C262961BFBF47452232183CF03B1C5950F733E0EF3A791
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-18 14:39
SpcSpOpusInfo: Globalsign 中国
VT detections: 42/68
Compilation time: 2021-04-18
PDB path: C:\Users\omen\Desktop\新建文件夹 (4)\x64\Release\netfilterdrv.pdb
Country submitter: Poland, United States, France, China, CZ
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u