viragt.sys

VirIT Agent System file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/
https://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/

7 known samples

1, 80, 0, 0 · its entry

ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850

1, 74, 0, 0 · its entry

2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a

1, 72, 0, 0 · its entry

e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53

1, 65, 0, 0 · its entry

2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8

1, 60, 0, 0 · its entry

d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605

1, 38, 0, 0 · its entry

e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148

1.25.0.0 · its entry

263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real viragt.sys?

file version info and known copies

ProductVirIT Agent System, TG Soft S.a.s.

DescriptionVirIT Agent System

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names viragt.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.