aswArPot.sys
AVG anti rootkit file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/57fc510a-e649-4599-b83e-8f3605e3d1d9/
42 known samples
Show the 42 samples’ SHA-256 hashes
21.4.237.0 · its entry
421cb64792a32ce79db7c8c07db4fb58bf105e58a7acf3cf1e6b5135e37795cf21.1.187.0 · its entry
4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f120.10.171.0 · its entry
2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f120.8.137.0 · its entry
17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca20.8.130.0 · its entry
0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad81891720.7.113.0 · its entry
19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da020.7.113.0 · its entry
3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b20.6.107.0 · its entry
5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c20.6.107.0 · its entry
ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb83320.5.96.0 · its entry
34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf20.4.83.0 · its entry
7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed20.4.83.0 · its entry
94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec520.3.68.0 · its entry
0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c20.3.68.0 · its entry
36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e28920.1.44.0 · its entry
bf5beb8560b85454ded94d2954c446970ab44dc2eeb83d80170ea3a68afa178719.7.4246.0 · its entry
8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d919.7.4246.0 · its entry
dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed25819.6.4235.0 · its entry
6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf19.5.4220.0 · its entry
65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c319.5.4220.0 · its entry
6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d19.4.4211.0 · its entry
e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f619.3.4239.0 · its entry
1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c19.3.4239.0 · its entry
1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a019.3.4224.0 · its entry
0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf19.2.4181.0 · its entry
a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c119.2.4157.0 · its entry
ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa319.1.4132.0 · its entry
2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c19.1.4132.0 · its entry
9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c718.8.4057.0 · its entry
0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb818.8.4057.0 · its entry
86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a888218.7.4031.0 · its entry
0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d18.7.4016.0 · its entry
4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba18.6.3979.0 · its entry
d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c918.5.3926.0 · its entry
1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd118.4.3891.0 · its entry
be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec218.3.3860.0 · its entry
2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb218.3.3848.0 · its entry
a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad18.2.3827.0 · its entry
e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d918.2.3820.0 · its entry
aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c18.1.3800.0 · its entry
1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f417.9.3761.0 · its entry
7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea17.9.3754.0 · its entry
14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real aswArPot.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names aswArPot.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.