CmdID

CmdID / Files

ComputerZ.Sys

Ludashi System Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/9bf033e4-7295-4b63-8772-638b76851741/

50 known samples

Show the 50 samples’ SHA-256 hashes

1.1020.1030.1217 · its entry

37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60

1.1020.1030.1217 · its entry

3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f

1.1019.1025.918 · its entry

64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66

1.1019.1025.918 · its entry

7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3

1.6.16.1015 · its entry

03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d

1.6.16.1015 · its entry

66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea

1.6.16.1005 · its entry

423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18

1.6.16.1005 · its entry

fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a

1.6.16.1000 · its entry

468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5

1.6.16.1000 · its entry

f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1

1.6.15.1045 · its entry

13ae3081393f8100cc491ebb88ba58f0491b3550787cf3fd25a73aa7ca0290d9

1.6.15.1045 · its entry

5c9e257c9740561b5744812e1343815e7972c362c8993d972b96a56e18c712f3

1.6.15.1045 · its entry

71c0ce3d33352ba6a0fb26e274d0fa87dc756d2473e104e0f5a7d57fab8a5713

1.6.15.1045 · its entry

8781589c77df2330a0085866a455d3ef64e4771eb574a211849784fdfa765040

1.6.15.1045 · its entry

e642d82c5cde2bc40a204736b5b8d6578e8e2b893877ae0508cfa3371fc254dc

1.6.15.1045 · its entry

ed3448152bcacf20d7c33e9194c89d5304dee3fba16034dd0cc03a3374e63c91

1.6.15.1040 · its entry

c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413

1.6.15.1040 · its entry

f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d

1.6.14.1024 · its entry

767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b

1.6.14.1024 · its entry

d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23

1.6.14.1023 · its entry

00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03

1.6.14.1022 · its entry

0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7

1.6.14.1022 · its entry

40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554

1.6.14.1021 · its entry

182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714

1.6.14.1021 · its entry

bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e

1.6.13.1019 · its entry

6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d

1.6.13.1019 · its entry

8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250

1.6.12.1018 · its entry

31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5

1.6.12.1018 · its entry

8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409

1.6.12.302 · its entry

26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd

1.6.12.302 · its entry

dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233

1.6.11.1129 · its entry

348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1

1.6.11.1129 · its entry

c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778

1.6.11.1008 · its entry

47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d

1.6.11.1008 · its entry

a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67

1.6.11.415 · its entry

39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d

1.6.11.415 · its entry

3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9

1.6.11.415 · its entry

a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1

1.3.10.1110 · its entry

5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab

1.3.10.1110 · its entry

d474ea066d416ded9ed8501c285ca6b1c26a1d1c813c8f6bd5523eeb66c5d01e

1.3.10.1110 · its entry

d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7

1.3.10.1110 · its entry

e502c2736825ea0380dd42effaa48105a201d4146e79de00713b8d3aaa98cd65

1.3.10.831 · its entry

07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8

1.3.10.831 · its entry

898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289

1.3.10.802 · its entry

386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8

1.3.10.802 · its entry

5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c

1.3.9.1105 · its entry

c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65

1.3.9.1105 · its entry

dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d

1.1.9.416 · its entry

61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629

1.0.8.818 · its entry

61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ComputerZ.Sys?

file version info and known copies
Product鲁大师, 360.cn
DescriptionLudashi System Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names ComputerZ.Sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.