SOC News: Article

One Article Review

Accueil - L'article:

Source	AhnLab
Identifiant	8307773
Date de publication	2023-02-06 12:00:00 (vue: 2023-02-07 01:08:34)
Titre	DarkSide Ransomware With Self-Propagating Feature in AD Environments
Texte	In order to evade analysis and sandbox detection, DarkSide ransomware only operates when the loader and data file are both present. The loader with the name “msupdate64.exe” reads the “config.ini” data file within the same path that contains the encoded ransomware and runs the ransomware on the memory area of a normal process. The ransomware is structured to only operate when a specific argument matches. It will then register itself to the task scheduler and run itself periodically. The following...
Envoyé	Oui
Condensat	“config “msupdate64 analysis are area argument both contains darkside data detection encoded environments evade exe” feature file following ini” itself loader matches memory name normal only operate operates order path periodically present process propagating ransomware reads register run runs same sandbox scheduler self specific structured task then when will within
Tags	Ransomware
Stories
Notes	★★★
Move

L'article ne semble pas avoir été repris aprés sa publication.

L'article ne semble pas avoir été repris sur un précédent.