RWTKrl.sys

RWTKrl file version info

Driver on Windows LOLDrivers malicious

A known malicious driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/00561455-9da1-4f0c-8564-e4c99b716a74/
https://www.loldrivers.io/drivers/4c4e7664-af86-4483-858a-f59346f3d304/
https://www.loldrivers.io/drivers/af153e7c-13fa-4a40-a095-00726ad6d783/

4 known samples

1.0.0.1006 · its entry

1a74c2bde0c9a76486657ccb9c79ea87c9891a32cdd4aa15c7542f7c9487a539

1.0.0.808 · its entry

930da474a6d1be97b54f2c81e883e14d62897aa58622e5b040e412bd36cee0a7

1.0.0.807 · its entry

090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49

0.1.0.251 · its entry

146b8f4fc91a4915e8f6aa6e0d871f7161a809c46760ef602bab534836142436

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real RWTKrl.sys?

file version info and known copies

ProductRansomwareTerminator, Pinchins Technology Co.,Ltd.

DescriptionRWTKrl

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.