CmdID / Files

VBoxTAP.sys

VirtualBox Host Interface Networking Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/

2 known samples

8/2 · its entry

994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4

8/2 · its entry

cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real VBoxTAP.sys?

file version info and known copies

ProductVirtualBox Host Interface Networking Driver, innotek GmbH

DescriptionVirtualBox Host Interface Networking Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.