CmdID / Files

rtkio64.sys

Realtek IO Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/

8 known samples

1.009.0709.2020 built by: WinDDK · its entry

4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7

1.008.0823.2017 built by: WinDDK · its entry

7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129

1.006.0118.2017 built by: WinDDK · its entry

074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761

1.005.0825.2016 built by: WinDDK · its entry

3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1

1.005.0825.2016 built by: WinDDK · its entry

442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c

1.004.0105.2016 built by: WinDDK · its entry

db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7

1.002.0116.2015 built by: WinDDK · its entry

8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c

1.001.0725.2012 built by: WinDDK · its entry

a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real rtkio64.sys?

file version info and known copies

ProductRealtek IO Driver, Realtek

DescriptionRealtek IO Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.