Ransom.WannaCry / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/84c82835a5d21bbcf75a61706d8ab549.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
ISR: ApparitionSec

Threat: Ransom.WannaCry
Vulnerability: Code Execution
Description: WannaCry looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware…

Read More

REvil.Ransom / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – malvuln.com (c) 2022
Original source:
https://malvuln.com/advisory/979635229dfcfae1aae74ae296ec78c8.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: REvil.Ransom
Vulnerability: Code Execution
Description: REvil looks for and executes DLLs in its current directory.
Therefore, we can potentially hijack a vuln DLL execute our own code,
control and terminate the malware pre-encryption. The exploit…

Read More

Ransom.Conti / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – malvuln.com (c) 2022
Original source:
https://malvuln.com/advisory/3c55ee6753408bff2e3e6a392ed9f2a0.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Ransom.Conti
Vulnerability: Code Execution
Description: Conti looks for and executes DLLs in its current directory.
Therefore, we can potentially hijack a vuln DLL execute our own code,
control and terminate the malware pre-encryption. The exploit…

Read More

Conti.Ransom / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – malvuln.com (c) 2022
Original source:
https://malvuln.com/advisory/710a77804637f65e22a2e230ff6444f9.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Conti.Ransom
Vulnerability: Code Execution
Description: Conti looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware pre-encryption. The exploit dll…

Read More

RedLine.Stealer / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – malvuln.com (c) 2022
Original source:
https://malvuln.com/advisory/0adb0e2ac8aa969fb088ee95c4a91536.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: RedLine.Stealer
Vulnerability: Code Execution
Description: RedLine looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware. The exploit dll will simply…

Read More