Dismiss this notice
EaseUS Todo Backup Home Giveaway - https://www.geeks.fyi/showthread.php?tid=12343

Dismiss this notice
EaseUS MobiSaver for Android 5.0 Giveaway - https://www.geeks.fyi/showthread.php?tid=12344

Dismiss this notice
Avast Premium Security FREE LICENSE Giveaway - https://www.geeks.fyi/showthread.php?tid=12417

Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
WastedLocker: technical analysis
#1
Bug 
Quote:
[Image: sl_WastedLocker_02.png]

The use of crypto-ransomware in targeted attacks has become an ordinary occurrence lately: new incidents are being reported every month, sometimes even more often.

On July 23, Garmin, a major manufacturer of navigation equipment and smart devices, including smart watches and bracelets, experienced a massive service outage. As confirmed by an official statement later, the cause of the downtime was a cybersecurity incident involving data encryption. The situation was so dire that at the time of writing of this post (7/29) the operation of the affected online services had not been fully restored.

According to currently available information, the attack saw the threat actors use a targeted build of the trojan WastedLocker. An increase in the activity of this malware was noticed in the first half of this year.

We have performed technical analysis of a WastedLocker sample.

Command line argumentsIt is worth noting that WastedLocker has a command line interface that allows it to process several arguments that control the way it operates.

 -p

Priority processing: the trojan will encrypt the specified directory first, and then add it to an internal exclusion list (to avoid processing it twice) and encrypt all the remaining directories on available drives.

 -f

Encrypt only the specified directory.

 -u username:password \\hostname

Encrypt files on the specified network resource using the provided credentials for authentication.

 -r

Launch the sequence of actions:
  1. Delete ;
  2. Copy to %WINDIR%\system32\.exe using a random substring from the list of subkeys of the registry key SYSTEM\CurrentControlSet\Control\;
  3. Create a service with a name chosen similarly to the method described above. If a service with this name already exists, append the prefix “Ms” (e.g. if the service “Power” already exists, the malware will create a new one with the name “MsPower”). The command line for the new service will be set to “%WINDIR%\system32\.exe -s”;
  4. Start this service and wait until it finishes working;
  5. Delete the service.
 -s:

Start the created service. It will lead to the encryption of any files the malware can find.
...
Continue Reading
Reply
#2
Additional Info: https://www.kaspersky.com/blog/wastedloc...ent/36626/
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Recent Posts
GFYI [Official] Avast Premium Security ...
"WHAT do you li...angustaver — 07:38
AV-Test.org - Best Windows AV software ...
F-Secure PSB Compute...jasonX — 20:34
Best VPN for Android TV
Just to add, Expr...jasonX — 20:27
Avast_Blog_Security News: An elections s...
Exploring the l...harlan4096 — 16:38
What Is Riskware? Cybersecurity Threats ...
In the Online W...harlan4096 — 16:31

[-]
Birthdays
Today's Birthdays
avatar (42)riafootgtap
avatar (33)fixlnub
Upcoming Birthdays
avatar (42)RussellRuigh
avatar (49)isyqop
avatar (39)AntoineLer
avatar (33)prefenouff
avatar (34)emogig
avatar (36)Isabelle88Nes
avatar (36)ferpuMip
avatar (33)kinotExaro
avatar (45)HerbertPab
avatar (42)Susanskymn
avatar (36)stepaRurry
avatar (32)torieyang
avatar (41)MichaelPlaup
avatar (34)JasonSoult
avatar (31)hyxamuc

[-]
Online Staff
There are no staff members currently online.

>