Driver intelligenceVulnerableVerified

rtkio.sys

Description not recorded.

UUID / 8d3f27bd-c3fd-48d0-913a-e2caa6fbd025ADDED / 2023-01-09AUTHOR / Michael Haag, Nasreddine Bencherchali

Known samples 14

11 recorded TRUE · 3 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

rtkio64.sysSample 1 · HVCI TRUE

MD5: 7aa34cd9ea5649c24a814e292b270b6f
SHA1: b21cba198d721737aabd882ada6c91295a5975ed
SHA256: 074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761
Imphash: 8ee2435c62b02fe0372cde028be489cb
Authentihash MD5: dbcdc8d0f902e064773b158644ee717d
Authentihash SHA1: 7593d46a73ec00e00aef3e9d0031c2b21b74ecfb
Authentihash SHA256: 64d060216cf55210f595609487b708d5e70e0706a8de0827369bf58898205f34
Machine: AMD64
Version: 1.006.0118.2017 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 2 · HVCI FALSE

MD5: ffd0c87d9bf894af26823fbde94c71b6
SHA1: eacfc73f5f45f229867ee8b2eb1f9649b5dd422e
SHA256: 916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677
Imphash: 6ce93eab57a73915ecd5c202a339f6ce
Authentihash MD5: d543d754cbb1d404d62b6c574a1aa3cd
Authentihash SHA1: daca8d39b72bbe8a5b6d5fa35bbb4ecef198a359
Authentihash SHA256: e657e54c341d37881837dbaf553e10bbe31ff2d6ccf9ca939ca5433ec464a73b
Machine: I386
Version: 6.0.6000.16386 built by: WinDDK
Publisher: Windows (R) Codename Longhorn DDK provider

Download vulnerable sample View on VirusTotal

rtkiow10x64.sysSample 3 · HVCI TRUE

MD5: 96a8b535b5e14b582ca5679a3e2a5946
SHA1: f6b3577ea4b1a5641ae3421151a26268434c3db8
SHA256: ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89
Imphash: 317f02ddc9809d608a9bf63ce24e9550
Authentihash MD5: 02f3eb42f514eb2652d6097e36874a1c
Authentihash SHA1: 3c5cc137458500a4a7a0be5860a02a00df92e2d8
Authentihash SHA256: 8944a3f50f38d92d17b8cfe2e08201a79ea30f38812d18f28036e59789d3f58c
Machine: AMD64
Version: 1.009.0709.2020
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 4 · HVCI FALSE

MD5: 664ad9cf500916c94fc2c0020660ac4e
SHA1: 444f96d8943aec21d26f665203f3fb80b9a2a260
SHA256: caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab
Imphash: d6c920c10d4d0f92f0ac14c3fefed233
Authentihash MD5: 2131039a2273befb71bfd7aedf9196b1
Authentihash SHA1: df5d3b52f987c4b48c6d164d8266e57c86a4a2d7
Authentihash SHA256: 1044ea40d459fe4c619a44afe53e6ff5a9cc5a37cf568d974ae23ed62da58759
Machine: AMD64
Version: 6.0.6000.16386 built by: WinDDK
Publisher: Windows (R) Codename Longhorn DDK provider

Download vulnerable sample View on VirusTotal

rtkio64.sysSample 5 · HVCI TRUE

MD5: 70dcd07d38017b43f710061f37cb4a91
SHA1: 99201c9555e5faf6e8d82da793b148311f8aa4b8
SHA256: 7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129
Imphash: f046e37fa7914491dc25a6f7718da341
Authentihash MD5: dbe68427fd1f2194715b4d146dedeae7
Authentihash SHA1: 118ebc5c7ac859d17c14ceeaa8ab973d694fdd7b
Authentihash SHA256: e46bb410c3bb95a1f3d61ced157c679bfac7dc997534e46b83b234a6fc5cbb14
Machine: AMD64
Version: 1.008.0823.2017 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 6 · HVCI FALSE

MD5: daf800da15b33bf1a84ee7afc59f0656
SHA1: 166759fd511613414d3213942fe2575b926a6226
SHA256: 478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82
Imphash: 6ce93eab57a73915ecd5c202a339f6ce
Authentihash MD5: d543d754cbb1d404d62b6c574a1aa3cd
Authentihash SHA1: daca8d39b72bbe8a5b6d5fa35bbb4ecef198a359
Authentihash SHA256: e657e54c341d37881837dbaf553e10bbe31ff2d6ccf9ca939ca5433ec464a73b
Machine: I386
Version: 6.0.6000.16386 built by: WinDDK
Publisher: Windows (R) Codename Longhorn DDK provider

Download vulnerable sample View on VirusTotal

rtkiow10x64.sysSample 7 · HVCI TRUE

MD5: b5ada7fd226d20ec6634fc24768f9e22
SHA1: 947db58d6f36a8df9fa2a1057f3a7f653ccbc42e
SHA256: 32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993
Imphash: 6faad89adbfc9d5448bb1bd12e7714cd
Authentihash MD5: 4d01000bdb93d60aa1ff5700b4b0a9a2
Authentihash SHA1: 5e85fc1f7ef1c3c2745c842739c0ab596f87f9f9
Authentihash SHA256: bc65d8ade2e72475a585307311e3058b3dbc4a7d2be6740c2c53a5902e698e7f
Machine: AMD64
Version: 1.008.0823.2017
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkiow8x64.sysSample 8 · HVCI TRUE

MD5: b8b6686324f7aa77f570bc019ec214e6
SHA1: 6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403
SHA256: 082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d
Imphash: 8122311437457ccae22578e301c6a17d
Authentihash MD5: d2914b13c253d24728fade34df3d91df
Authentihash SHA1: fa7fbb04748088557085ef3060b5fdb65a7b6b10
Authentihash SHA256: ed68f30f8246730c2b57495ed1db1480350d879b01d070999d35f38630865f5c
Machine: AMD64
Version: 1.008.0823.2017
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 9 · HVCI TRUE

MD5: f23b2adcfab58e33872e5c2d0041ad88
SHA1: db006fa522142a197686c01116a6cf60e0001ef7
SHA256: 8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c
Imphash: 6f2d756d22c285a46206de3bfde6c79d
Authentihash MD5: 323c438f0a5a5e25ab49d996f968e876
Authentihash SHA1: f9399f08551048d8c72269d26ad1ac09a463d87f
Authentihash SHA256: aff3f4d25b85b6b3147d2b7f586edc3e9aa2ec25c37d5dc7ad809d99677497ea
Machine: AMD64
Version: 1.002.0116.2015 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 10 · HVCI TRUE

MD5: dd050e79c515e4a6d1ae36cac5545025
SHA1: c0100f8a8697a240604b3ea88848dd94947c7fd3
SHA256: a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af
Imphash: 11bfcbdb0787ef461d442f973c392cf6
Authentihash MD5: b63a971807801d7c8873059cd5eef56f
Authentihash SHA1: 7e75c5237b2536a8ffb04bc9db85b421f560ee80
Authentihash SHA256: 4ecb25cb7a127729a0124d1c0e0ba7dd0c24a02f48f40f6af174b15581b6925c
Machine: AMD64
Version: 1.001.0725.2012 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 11 · HVCI TRUE

MD5: 96e10a2904fff9491762a4fb549ad580
SHA1: 02a8b74899591da7b7f49c0450328d39b939d7e4
SHA256: 4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7
Imphash: 4343c9c0b78ee21e895f10d929c240d4
Authentihash MD5: b21ab759cfaa77178c30c8b43678707d
Authentihash SHA1: e66b3b650761b1272b22d46ab41649b8a5c26603
Authentihash SHA256: 902b754dd302a994074ea8d3e619d2f9000e6c6997e428f19f41533f7c5e192c
Machine: AMD64
Version: 1.009.0709.2020 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 12 · HVCI TRUE

MD5: 4e67277648c63b79563360dac22b5492
SHA1: 064847af77afca8a879a9bf34cb87b64b5e69165
SHA256: 3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1
Imphash: 085a78615099ffefa2df0a31da3058d8
Authentihash MD5: d5757762e2ab3f34b0fa097b9abd3b90
Authentihash SHA1: bdcbf070f68d8eecc47d7efbd9f377e8e652d026
Authentihash SHA256: f3308899fc0ebdd04a4dacc386873c25dabe32a8f34607fb335148d2dab667d8
Machine: AMD64
Version: 1.005.0825.2016 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 13 · HVCI TRUE

MD5: 7dd538bcaa98d6c063ead8606066333f
SHA1: 2eddb10eecef740ec2f9158fa39410ec32262fc3
SHA256: db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7
Imphash: abdaca21ab5c831000b0aa4b8f357716
Authentihash MD5: 9335f6098f8706ebb83466fbd449bc0f
Authentihash SHA1: 533e7f159d3adb334067257f80073e33accaa483
Authentihash SHA256: ed617d4c50288921a6a760de19db1633bd8172421109dcf68082c67db085ddb1
Machine: AMD64
Version: 1.004.0105.2016 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

rtkio.sysSample 14 · HVCI TRUE

MD5: 34edf3464c3f5605c1ca3a071f12e28c
SHA1: 164c899638bc83099c0379ea76485194564c956c
SHA256: 442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c
Imphash: 085a78615099ffefa2df0a31da3058d8
Authentihash MD5: e13260e98e8c2ff45d504114da8117e8
Authentihash SHA1: 16b17721cf655f2442bf3865a9329f96e1e15295
Authentihash SHA256: c6389dca278be297b95846badc2b6859b488f123dbdc5d7bfc6f4393eeb7e678
Machine: AMD64
Version: 1.005.0825.2016 built by: WinDDK
Publisher: Realtek

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create rtkio64.sys binPath=C:\windows\temp\rtkio64.sys type=kernel && sc.exe start rtkio64.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

rtkio.sys

Known samples 14

Recorded command

Research & references