CmdID

CmdID / Files

NICM.sys

Novell Client Portability Layer file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/0f8e317e-ad2b-4b02-9f96-603bb8d28604/
https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/
https://www.loldrivers.io/drivers/8ff4ab50-05b7-4bfa-b994-1920c4ed4978/

23 known samples

Show the 23 samples’ SHA-256 hashes

3.1.12.0 · its entry

00b3ff11585c2527b9e1c140fd57cb70b18fd0b775ec87e9646603056622a1fd

3.1.12.0 · its entry

18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7

3.1.12.0 · its entry

3140005ce5cac03985f71c29732859c88017df9d41c3761aa7c57bbcb7ad2928

3.1.12.0 · its entry

94c226a530dd3cd8d911901f702f3dab8200d1d4fdc73fcb269f7001f4e66915

3.1.12.0 · its entry

c08581e3e444849729c5b956d0d6030080553d0bc6e5ae7e9a348d45617b9746

3.1.11.0 · its entry

3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0

3.1.11.0 · its entry

4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4

3.1.11.0 · its entry

6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44

3.1.11.0 · its entry

84739539aa6a9c9cb3c48c53f9399742883f17f24e081ebfa7bfaaf59f3ed451

3.1.11.0 · its entry

8b688dd055ead2c915a139598c8db7962b42cb6e744eaacfcb338c093fc1f4e7

3.1.11.0 · its entry

a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00

3.1.11.0 · its entry

e279e425d906ba77784fb5b2738913f5065a567d03abe4fd5571695d418c1c0f

3.1.11.0 · its entry

e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717

3.1.10.0 · its entry

1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7

3.1.10.0 · its entry

76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb

3.1.6.0 · its entry

1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b

3.1.6.0 · its entry

6b71b7f86e41540a82d7750a698e0386b74f52962b879cbb46f17935183cd2c7

3.1.6.0 · its entry

6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d

3.1.6.0 · its entry

904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a

3.1.6.0 · its entry

cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190

3.1.6.0 · its entry

dd4fedd5662122cbfe046a12e2137294ef1cb7822238d9e24eacc78f22f8e93d

3.1.6.0 · its entry

ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613

3.1.0.0 · its entry

7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real NICM.sys?

file version info and known copies
ProductNovell XTier, Novell, Inc.
DescriptionNovell Client Portability Layer

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names NICM.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.