FB93C8283E92FAA03CF88908D6528BCF71950FC1D6DA68CEAF51BA7A6A194D90.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 43/73

Driver Name: FB93C8283E92FAA03CF88908D6528BCF71950FC1D6DA68CEAF51BA7A6A194D90.sys
MD5: f8d990c2280d92e13007ccf9e9396752
SHA1: 6c10c5522fab374cb8bb2c17715c0a74741c8994
SHA256: fb93c8283e92faa03cf88908d6528bcf71950fc1d6da68ceaf51ba7a6a194d90
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: dad93af05e685e42550f669ceb573d948229d7fc51eae522ae5436f83a64e984
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:os0vJN4lzbOkdPBykNIeP8lZAiT+nI1/DKbwuaqhhrLSgnQ91vPCgPo:ozIFvUkNilViIVDdufDrLI91vPvw
TLSH: T18865AE59E39273E8CC26C4745127F906F2B02E0E43EC8FEBF7C66B907B566909165B06
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 43/73
Compilation time: 2022-06-30
PDB path: D:\protect_sys\保护驱动\x64\Win7Release\ProtectXPF.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.