4bf4b425-10af-4cd4-88e6-beb4b947eb48

IObitUnlocker.sys

We were not able to verify the hash of this driver successfully, it has not been confirmed.

Description

IObitUnlocker.sys is a vulnerable driver and more information will be added as found.

UUID: 4bf4b425-10af-4cd4-88e6-beb4b947eb48
Created: 2023-01-09
Author: Michael Haag
Acknowledgement: |

This download link contains the vulnerable driver!

Commands

sc.exe create IObitUnlocker.sys binPath=C:\windows\temp\IObitUnlocker.sys     type=kernel &amp;&amp; sc.exe start IObitUnlocker.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

Known Vulnerable Samples

Property	Value
Filename	IObitUnlocker.sys
MD5	2391fb461b061d0e5fccb050d4af7941
SHA1	7c6cad6a268230f6e08417d278dda4d66bb00d13
SHA256	f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004
Authentihash MD5	751c91ae91cb43aadaeaa1bb187c593a
Authentihash SHA1	dd220acea885a954085e614b94da2b5bba5c0cc3
Authentihash SHA256	e0aff24a54400fe9f86564b8ce9f874e7ff51e96085ff950baff05844cff2bd1
RichPEHeaderHash MD5	35ffa69ed506b3a5d24d6e9c10f88070
RichPEHeaderHash SHA1	a5d21268d58eebe7c8e0921d0079974d8541ffb7
RichPEHeaderHash SHA256	7068185b0f6869fa20b8c64c2e6f2c3bedc161bc4118e602df47da640013cb62
Company	IObit Information Technology
Description	Unlocker Driver
Product	Unlocker
OriginalFilename	IObitUnlocker.sys

Download

Certificates

Expand

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 0d98f5df96c592c5b76bfde1cb823096

Field	Value
ToBeSigned (TBS) MD5	d0ba095f2bdb679cea084b4106479484
ToBeSigned (TBS) SHA1	80aba0ecbd2b71c84bc73ac42963bc9ce247a020
ToBeSigned (TBS) SHA256	a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa
Subject	??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD
ValidFrom	2019-08-27 00:00:00
ValidTo	2022-08-30 12:00:00
Signature	89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0d98f5df96c592c5b76bfde1cb823096
Version	3

Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06

Field	Value
ToBeSigned (TBS) MD5	f92649915476229b093c211c2b18e6c4
ToBeSigned (TBS) SHA1	2d54c16a8f8b69ccdea48d0603c132f547a5cf75
ToBeSigned (TBS) SHA256	2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
ValidFrom	2012-04-18 12:00:00
ValidTo	2027-04-18 12:00:00
Signature	9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	0dd0e3374ac95bdbfa6b434b2a48ec06
Version	3

Imports

Expand

ntoskrnl.exe

Imports

Expand

ntoskrnl.exe

ImportedFunctions

Expand

ExAllocatePoolWithTag
IoDeleteSymbolicLink
ExFreePoolWithTag
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
_wcsnicmp
ZwReadFile
IoGetRelatedDeviceObject
MmGetSystemRoutineAddress
KeInitializeEvent
ExInterlockedPopEntryList
KeDelayExecutionThread
IoFileObjectType
ZwWaitForSingleObject
ZwCreateFile
ExAllocatePool
IoGetCurrentProcess
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlCompareUnicodeString
IoAllocateIrp
ObfDereferenceObject
ZwQueryInformationFile
ZwWriteFile
ObOpenObjectByPointer
DbgPrint
IofCallDriver
_wcsicmp
PsGetProcessPeb
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
RtlInitUnicodeString
KeSetEvent
RtlAppendUnicodeToString
IoCreateFile
ZwQuerySystemInformation
ZwOpenSymbolicLinkObject
KeUnstackDetachProcess
ObQueryNameString
wcsrchr
ZwQueryDirectoryFile
_vsnwprintf
RtlAppendUnicodeStringToString
ZwDuplicateObject
IoFreeIrp
ZwOpenProcess
PsGetCurrentProcessId
MmIsAddressValid
ZwTerminateProcess
ExInterlockedPushEntryList
KeStackAttachProcess
KeBugCheckEx
__C_specific_handler

ExportedFunctions

Expand

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "61204db4000000000027",
      "Signature": "208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA",
      "TBS": {
        "MD5": "8e3ffc222fbcebdbb8b23115ab259be7",
        "SHA1": "ee20bff28ffe13be731c294c90d6ded5aae0ec0e",
        "SHA256": "59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821",
        "SHA384": "f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"
      },
      "ValidFrom": "2011-04-15 19:45:33",
      "ValidTo": "2021-04-15 19:55:33",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0d98f5df96c592c5b76bfde1cb823096",
      "Signature": "89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD",
      "TBS": {
        "MD5": "d0ba095f2bdb679cea084b4106479484",
        "SHA1": "80aba0ecbd2b71c84bc73ac42963bc9ce247a020",
        "SHA256": "a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa",
        "SHA384": "8293c567ba382434adab5899693e47e5d6e06c0b9f3c158bf17675d5a1476627db51d00dc9573bf4b89412617e651ba6"
      },
      "ValidFrom": "2019-08-27 00:00:00",
      "ValidTo": "2022-08-30 12:00:00",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "0dd0e3374ac95bdbfa6b434b2a48ec06",
      "Signature": "9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA",
      "TBS": {
        "MD5": "f92649915476229b093c211c2b18e6c4",
        "SHA1": "2d54c16a8f8b69ccdea48d0603c132f547a5cf75",
        "SHA256": "2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb",
        "SHA384": "511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"
      },
      "ValidFrom": "2012-04-18 12:00:00",
      "ValidTo": "2027-04-18 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA",
      "SerialNumber": "0d98f5df96c592c5b76bfde1cb823096",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2023-12-02