CmdID / Files

mst.sys

MST Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/0e94f1a2-beab-4adb-9687-eb2719a201c9/

1 known sample

0.1.0.0 · its entry

bf8d3377fc0834828afcc94165172333b2e1b58fb37d45be91a07d8d2e54d431

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real mst.sys?

file version info and known copies

ProductMST (Mellanox Support Tools), Mellanox Technologies Ltd.

DescriptionMST Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.