CmdID / Files

fbiosdrv.sys

Fujitsu BIOS Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/dc82ae79-d3e2-439a-a4c7-ec1f23e1261b/

9 known samples

2.4.0.0 · its entry

6e06493619cf1358bd2c5aafd375e78bba233b835e9d9ef21eafee30c23a62d9

2.3.40.0 · its entry

1955a346d1e414f354c69fe86a846450403d456739f8adeef17281056f8b71da

2.3.40.0 · its entry

444f9593bcbdaca3178bbe5da06d8641dd62bf4dbf1efad213e130f66800ac86

2.2.32.0 · its entry

5c4772d82a13d4169df33c35d411d8c62ea4ee4ee52e7d5508d81844421ad06b

2.2.32.0 · its entry

678fe5aa24a610ef149b30371edb7ad56b12fd0b7f5083c1d15ea091ec20a0a1

2.2.32.0 · its entry

e07be5f25f16a4afc01562aac0e123e6f3b25ed7ba75d114328b4ec445c21440

1.2.2.0 · its entry

23b2615f9417d6545ad595492a4423f1330bbc7cde32a95a219b63b4c28ea8de

1.2.2.0 · its entry

25848f00e6cc7f5b7db1c52870d3592ea3dbaab00df76b5b7c542d3c9823d049

1.2.1.0 · its entry

23a99ab2bd0ad069a088a2b256bf45ff96082e33ed2580ae06eeca06c053bec8

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real fbiosdrv.sys?

file version info and known copies

ProductFujitsu BIOS Driver, FUJITSU CLIENT COMPUTING LIMITED

DescriptionFujitsu BIOS Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.