WibuKey64.sys
WibuKey Windows NT Kernel Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
3 known samples
Version 6.70 of 2024- Aug- 28(Build 6532) · its entry
3e74265e10f596a89f2725b1fb19bd7098113d16301208c81b32356b34ee378aVersion 6.50a of 2019-Jan-08 (Build 3314) · its entry
7ab52ce255f4ee1d192e9a3cc0b836eaea10bd3c2d0d732519eb2f5968617ffdVersion 6.40 of 2016-Dec-14 (Build 2400) · its entry
17cf356d124df2afd44bfd1e26c1bd0dd5c73dc4709525a4d84b481a2e44771bFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real WibuKey64.sys?
ProductWibuKey Software Protection System, WIBU-SYSTEMS AG
DescriptionWibuKey Windows NT Kernel Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.