Category Archives: Advisories

Ransom.Conti / Code Execution

Read Time:20 Second

Posted by malvuln on May 07

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/20f0c736a966142de88dee06a2e4a5b1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Ransom.Conti
Vulnerability: Code Execution
Description: Conti looks for and executes DLLs in its current directory.
Therefore, we can potentially hijack a vuln DLL execute our own code,
control and terminate the malware pre-encryption….

Read More

Ransom.Petya / Code Execution

Read Time:20 Second

Posted by malvuln on May 07

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/8ed9a60127aee45336102bf12059a850.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Ransom.Petya
Vulnerability: Code Execution
Description: Petya looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware pre-encryption. The…

Read More

Ransom.Cryakl / Code Execution

Read Time:20 Second

Posted by malvuln on May 07

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/2aea3b217e6a3d08ef684594192cafc8.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Ransom.Cryakl
Vulnerability: Code Execution
Description: Cryakl looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware pre-encryption. The…

Read More

Trojan-Ransom.Radamant / Code Execution

Read Time:19 Second

Posted by malvuln on May 07

Discovery / credits: Malvuln – (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/6152709e741c4d5a5d793d35817b4c3d.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Ransom.Radamant
Vulnerability: Code Execution
Description: Radamant tries to load a DLL named “PROPSYS.dll” and execute a
hidden PE file “DirectX.exe” from the AppDataRoaming directory. Therefore,
we can…

Read More