CmdID / Files

libwasys.sys

OESIS V4 Helper Driver (x64) file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1562.001

Its entryhttps://www.loldrivers.io/drivers/0f50f568-bd09-4d8a-a73d-d37bdd0a1cb6/

2 known samples

10.3.2951.0 · its entry

24a4dd32b633781c8c1193c9b445388ca7277799941a36ba9977b84382125e5c

10.3.85.0 · its entry

04fda396f42384d9295fe306336ee4a685a0c341debdc27ddf9169f0336b46a6

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real libwasys.sys?

file version info and known copies

ProductOESIS V4 Kernel Driver, OPSWAT, Inc.

DescriptionOESIS V4 Helper Driver (x64)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.