Driver182.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2021-04-18 13:07 VT 48/73

Driver Name: Driver182.sys
MD5: 8e53a1ede3109f890e5259146a4821dd
SHA1: e14755ca8751d2b52c54c0c2f5ccd2682b06e7e9
SHA256: fd8a5313bf63f5013dc126620276fb4f0ef26416db48ee88cbaaca4029df1d73
Imphash: 74f66c8146092a4f48b341a6b45d4f38
Vhash: 024066551d1516151iz11xz
Authentihash: 7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f
Rich PE header hash: c760e0b7c9b39841e405ef93f7f13f7a
SSDEEP: 384:80t/jV7k0lpVXJ8ND5KxxSDKb2JBMobrPFR/ZhNs9lE+2c:JFKiOEb2YoXbrNxc
TLSH: T1A4D26BD666A800C3EE63A8B08290D683BD7FF7571701A5CB0663D5650EB3BC59F35928
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2021-04-18 13:07
SpcSpOpusInfo: Globalsign 中国
VT detections: 48/73
Compilation time: 2021-04-18
PDB path: C:\Users\omen\Desktop\新建文件夹 (4)\x64\Release\netfilterdrv.pdb
Country submitter: AT, United Kingdom, France
Flag: Malicious

Description

Netfilter is a rootkit. Its core function was IP redirection — routing the infected machine’s traffic through an attacker-controlled proxy and communicating with a command-and-control server to fetch configuration and updates.

It installed a root certificate pulled from its C2 into the Windows certificate store, and set a system-wide proxy by writing to the AutoConfigURL registry key. The dropper deployed the driver as netfilter.sys and registered it to run.

IOCs

110.42.4[.]180

hxxp://110.42.4[.]180:2080/u

hxxp://110.42.4[.]180:2081/u