CmdID

CmdID / Files

libnicm.sys

Novell XTCOM Services Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/
https://www.loldrivers.io/drivers/a0fbd397-64d5-4af2-844b-b096e08a1866/

24 known samples

Show the 24 samples’ SHA-256 hashes

3.1.12.0 · its entry

3b7177e9a10c1392633c5f605600bb23c8629379f7f42957972374a05d4dc458

3.1.12.0 · its entry

72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35

3.1.12.0 · its entry

87e094214feb56a482cd8ae7ee7c7882b5a8dccce7947fdaa04a660fa19f41e5

3.1.12.0 · its entry

95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3

3.1.12.0 · its entry

d04c72fd31e7d36b101ad30e119e14f6df9cbc7a761526da9b77f9e0b9888bc4

3.1.11.0 · its entry

00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922

3.1.11.0 · its entry

4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4

3.1.11.0 · its entry

66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796

3.1.11.0 · its entry

8138b219a2b1be2b0be61e5338be470c18ad6975f11119aee3a771d4584ed750

3.1.11.0 · its entry

ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a

3.1.11.0 · its entry

da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d

3.1.11.0 · its entry

e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48

3.1.11.0 · its entry

f27febff1be9e89e48a9128e2121c7754d15f8a5b2e88c50102cecee5fe60229

3.1.10.0 · its entry

834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78

3.1.10.0 · its entry

e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21

3.1.6.0 · its entry

0cfb7ea2cc515a7fe913ab3619cbfcf1ca96d8cf72dc350905634a5782907a49

3.1.6.0 · its entry

66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e

3.1.6.0 · its entry

6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259

3.1.6.0 · its entry

7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0

3.1.6.0 · its entry

b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b

3.1.6.0 · its entry

b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e

3.1.6.0 · its entry

d1c78c8ba70368e96515fb0596598938a8f9efa8f9f5d9e068ee008f03020fee

3.1.6.0 · its entry

dd2f1f7012fb1f4b2fb49be57af515cb462aa9c438e5756285d914d65da3745b

3.1.5.0 · its entry

c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real libnicm.sys?

file version info and known copies
ProductNovell XTier, Novell, Inc.
DescriptionNovell XTCOM Services Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names libnicm.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.