CmdID

CmdID / Files

iobitunlocker.sys

IObitUnlocker Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/

24 known samples

Show the 24 samples’ SHA-256 hashes

1.3.0.10 · its entry

f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004

1.2.0.2 · its entry

2ba404c50684d59b701959a1732617dec6a6a25c8005294c0d2b3822b38479a4

1.2.0.1 built by: WinDDK · its entry

c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66

1.2.0.0 built by: WinDDK · its entry

0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09

1.2.0.0 built by: WinDDK · its entry

2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae

1.2.0.0 built by: WinDDK · its entry

507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29

1.2.0.0 built by: WinDDK · its entry

5ea5f339b2e40dea57378626790ca7e9a82777aacdada5bc61ebb7d82043fa07

1.2.0.0 built by: WinDDK · its entry

969f73a1da331e43777a3c1f08ec0734e7cf8c8136e5d469cbad8035fbfe3b47

1.2.0.0 built by: WinDDK · its entry

a38c26c0754f6c9389ea43dd0149db26b95742c1b37468fcf0d8ced66da1dcb9

1.2.0.0 built by: WinDDK · its entry

a92d2736c8cd99195a1ef4d0d9a3412bee481acf585944e3b5946b465361a3e7

1.2.0.0 built by: WinDDK · its entry

b0dd55b4dc7e561dfe413b029673674e2a5381f5f4daede03ddf3484310a6e11

1.2.0.0 built by: WinDDK · its entry

b6ae324b84a4632cf690dd565954d64b205104fc3fa42181612c3f5b830579c6

1.2.0.0 built by: WinDDK · its entry

c2e1a3dd0dfb3477a3e855368b23d12b8818df8fa3bc3508abf069a0873d6bf8

1.2.0.0 built by: WinDDK · its entry

d3e95b8d8cbb0c4c3bb78d929408b37fd3b8f305b6234f7f03954465d52454eb

1.2.0.0 built by: WinDDK · its entry

d8096325bfe81b093dd522095b6153d9c4850ba2eaa790e12e7056ef160d0432

1.2.0.0 built by: WinDDK · its entry

faa9aa7118ecf9bb6594281f6b582f1ced0cc62d5db09a2fbf9b7ce70c532285

its entry

0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556

its entry

11bc55c0771d692279298211c1d434c04168e7c7f7c4328bfd600215b88c819b

its entry

29cf2d374d7afe009bbf60ba5f50db7016314de682cf3a6f90c0996810c821ef

its entry

698353791261d5a9ca3245ae8f86334493df554690ec7962895c2affe4050db2

its entry

7a1feb8649a5c0679e1073e6d8a02c8a6ebc5825f02999f16c9459284f1b198b

its entry

831b62145c21557928a694e6261e830f1545b5756ad51dcbd28a15fde570f4e7

its entry

a7416a7d9573f1d8873ec1b3109ec683e85412ba817e0001c3ab2d2c92043d4d

its entry

e41d4fd99252fcf9aea529b6e148b311aa26a4ab04f6b79cce4cd19c61db0c87

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real iobitunlocker.sys?

file version info and known copies
ProductIObitUnlocker, IObit
DescriptionIObitUnlocker Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names iobitunlocker.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.