800+ IT
News
als RSS Feed abonnieren📚 Trojan.Ransom.Ryuk.A MVID-2022-0640 Code Execution
💡 Newskategorie: IT Security Tools
🔗 Quelle: packetstormsecurity.com
Trojan.Ransom.Ryuk.A ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a DLL, execute our own code, and control and terminate the malware pre-encryption. Once loaded the exploit dll will check if the current directory is "C:\Windows\System32" and if not, we grab our process ID and terminate. All basic tests were conducted successfully in a virtual machine environment. ...