ElbyCDIO.sys
ElbyCD Windows x64 I/O driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/
32 known samples
Show the 32 samples’ SHA-256 hashes
6, 0, 3, 2 · its entry
238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e46, 0, 3, 2 · its entry
b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f8906, 0, 2, 0 · its entry
eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b6, 0, 2, 0 · its entry
f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad6, 0, 1, 6 · its entry
1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad4416, 0, 1, 3 · its entry
16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e16, 0, 1, 2 · its entry
033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c76, 0, 1, 2 · its entry
ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d476, 0, 1, 1 · its entry
5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca1856, 0, 1, 1 · its entry
9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d6, 0, 1, 0 · its entry
8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f606, 0, 1, 0 · its entry
828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff26, 0, 0, 9 · its entry
9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b63406, 0, 0, 7 · its entry
7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd06, 0, 0, 7 · its entry
82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c22673869896, 0, 0, 4 · its entry
f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d44396, 0, 0, 2 · its entry
2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae4456, 0, 0, 2 · its entry
3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb6, 0, 0, 1 · its entry
7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae66, 0, 0, 1 · its entry
7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a966, 0, 0, 1 · its entry
8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f006, 0, 0, 1 · its entry
b11e109f6b3dbc8aa82cd7da0b7ba93d07d9809ee2a4b21ec014f6a676a530276, 0, 0, 1 · its entry
c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe96, 0, 0, 1 · its entry
d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e6, 0, 0, 1 · its entry
fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d175, 1, 0, 1 · its entry
83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc5, 0, 0, 0 · its entry
0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c4, 3, 1, 1 · its entry
1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a4, 3, 0, 3 · its entry
51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c02924, 2, 0, 0 · its entry
af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e13, 0, 0, 0 · its entry
07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d881, 0, 1, 0 · its entry
98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97eFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real ElbyCDIO.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names ElbyCDIO.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.