viragt64.sys

VirIT Agent System file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/
https://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/
https://www.loldrivers.io/drivers/c3cca618-5a7f-4a51-8785-cb328fbfb0df/

4 known samples

1, 0, 0, 5 · its entry

a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641

1, 0, 0, 4 · its entry

9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285

1, 0, 0, 11 · its entry

58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495

1, 0, 0, 0 · its entry

18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real viragt64.sys?

file version info and known copies

ProductVirIT Agent System, TG Soft S.a.s.

DescriptionVirIT Agent System

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names viragt64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.