CmdID / Files

VBoxUSBMon.sys

VirtualBox USB Monitor Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/

2 known samples

1.00 · its entry

3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40

1.00 · its entry

8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real VBoxUSBMon.sys?

file version info and known copies

ProductVirtualBox USB Monitor Driver, innotek GmbH

DescriptionVirtualBox USB Monitor Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.