ngiodriver.sys
avast! NG setup helper driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
12 known samples
11.0.0.362 · its entry
5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e97587910.0.0.1126 · its entry
1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a10.0.0.1126 · its entry
e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e704899410.0.0.320 · its entry
42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c18010.0.0.320 · its entry
c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b10.0.0.207 · its entry
733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e10.0.0.207 · its entry
d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a410.0.0.69 · its entry
85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a310.0.0.52 · its entry
2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f910.0.0.52 · its entry
d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb10.0.0.37 · its entry
1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f6710.0.0.33 · its entry
5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52eaFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real ngiodriver.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names ngiodriver.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.