f59a1409ce773658e72ad73424841890.virus

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-06-30 13:26 VT 39/72

Driver Name: f59a1409ce773658e72ad73424841890.virus
MD5: f59a1409ce773658e72ad73424841890
SHA1: 04430badfc88df24200f64131a0edb0ea00d0751
SHA256: ff41e1793711ed6db07199133d83dd428cf7ea2ac676665bb6a184ee57b2f2d3
Imphash: 57f0dcceaca90aeed434f9147668e95d
Vhash: 016086555d15761656651iz6yz
Authentihash: 21e54fdb51105f85fed891aab9c7d6f7a2344f3cad1dfed1eaec5966d1a41c9e
Rich PE header hash: fedc029159c951646c1868ccf03315c6
SSDEEP: 24576:876wFz/dHfd9In+/yc4RInm07a1gmaUWIhSjcckQdySDiohrFsW4MBFAn:8PxdHfdS+L1xME9LkCyOi+z/Qn
TLSH: T161659EB9E3477398CC16C9705127F906F2B02D0943EC5FEBF7D2ABA06B576A09125B09
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-06-30 13:26
SpcSpOpusInfo: 厦门龙小虾网络科技有限公司
VT detections: 39/72
Compilation time: 2022-06-30
PDB path: D:\投影仪\httpToSocket\x64\Win7Release\HttpToSocket.pdb
Country submitter: China, Canada
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.