97318e51.sys
- Driver Name
97318e51.sys- MD5
ddee86b84dcb72835b57b1d049e9e0cd- SHA1
2b6907c7cefa8d41bd585e784619ba606f317c8e- SHA256
fd765103cd948bd0099cc05782348f2b425441a87a7f38f1bfcdb185aecca84d- Imphash
633c885f57ccee60fa69445dea1892b7- Vhash
016096555d55761656651iz57xz- Authentihash
f592798963e3c3e9f05952f01c0c433043701fc4f0ec674efa1d45f5b54a08b3- Rich PE header hash
49efdb57a690b47c35210027f9cb225c- SSDEEP
49152:dYlwUpOqbxl08oPvzdx8s00Uxz1wAR5sps:dDLklEy0PARx- TLSH
T103858DA5E3131298CC71C4B0997A7917A5717D1883AD1FF7F386BBA0AB0E5D0A239F44- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2021-07-29 09:25- SpcSpOpusInfo
福建奥创互娱科技有限公司- VT detections
44/71- Compilation time
2021-07-29- PDB path
E:\巨灵驱动源码\FiveSys_1\x64\Debug\FiveSys.pdb- Country submitter
- Indonesia, YE, Russia, Netherlands, Germany, China
- Flag
- Malicious
Description
FiveSys is a rootkit. Its core function was redirecting the infected machine’s internet traffic through an attacker-controlled proxy, selected from a built-in list of 300 “.xyz” domains stored encrypted inside the binary.
The redirection covered both HTTP and HTTPS, and to make HTTPS interception work it installed its own custom root certificate on the system. It also hardened itself by blocking registry edits and preventing other rootkits and malware from installing.
IOCs
zkrf8ar[.]xyz