Threat: Trojan-Ransom.LockerGoga
Vulnerability: Code Execution
Description: LockerGoga looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware…
Threat: Ransom.CTBLocker
Vulnerability: Code Execution
Description: CTBLocker looks for and executes DLLs in its current
directory. Therefore, we can hijack a vuln DLL, execute our own code,
control and terminate the malware…
Threat: Trojan-Ransom.Cerber
Vulnerability: Code Execution
Description: Cerber looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware…
Threat: Trojan.Ransom.Cryptowall
Vulnerability: Code Execution
Description: Cryptowall looks for and executes DLLs in its current
directory. Therefore, we can hijack a vuln DLL, execute our own code,
control and terminate the malware…
Threat: REvil.Ransom
Vulnerability: Code Execution
Description: REvil looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware pre-encryption. The…
Threat: Ransom.WannaCry
Vulnerability: Code Execution
Description: WannaCry looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware…
Threat: REvil.Ransom
Vulnerability: Code Execution
Description: REvil looks for and executes DLLs in its current directory.
Therefore, we can potentially hijack a vuln DLL execute our own code,
control and terminate the malware pre-encryption. The exploit…
Threat: Ransom.Conti
Vulnerability: Code Execution
Description: Conti looks for and executes DLLs in its current directory.
Therefore, we can potentially hijack a vuln DLL execute our own code,
control and terminate the malware pre-encryption. The exploit…
Threat: Conti.Ransom
Vulnerability: Code Execution
Description: Conti looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware pre-encryption. The exploit dll…
Threat: RedLine.Stealer
Vulnerability: Code Execution
Description: RedLine looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware. The exploit dll will simply…
