atillk64.sys
ATI Diagnostics Hardware Abstraction Sys file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/
8 known samples
5.11.9.0 · its entry
38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d75.11.9.0 · its entry
5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a5.11.9.0 · its entry
6c6c5e35accc37c928d721c800476ccf4c4b5b06a1b0906dc5ff4df71ff509435.11.9.0 · its entry
ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f1735.11.9.0 · its entry
be66f3bbfed7d648cfd110853ddb8cef561f94a45405afc6be06e846b697d2b05.11.9.0 · its entry
c825a47817399e988912bb75106befaefae0babc0743a7e32b46f17469c78cad5.10.20.0 · its entry
11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f5.10.20.0 · its entry
d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4bFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real atillk64.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names atillk64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.