内容仅以原始语言提供
class="post-article">
Ransomware C/C++ 自2024年起活跃

RansomComponent

Small (100KB) PE32 ransomware component. vssadmin Delete Shadows /all /quiet (shadow copy destruction). vssadmin resize shadowstorage (backup prevention). net stop x5 (service kill). taskkill /IM msaess.exe (McAfee Agent). CreateRemoteThread injection.

威胁档案
类型 Ransomware
编程语言C/C++
C2协议Local
首次发现2024
目标 Küresel
用途 / 能力
  • Shadow Copy Destruction/Service Kill
尚未发现该家族的 C2 服务器。

研究报告 (1)

Kritik

RansomComponent ae355c32 -- vssadmin Delete Shadows Golge Kopya Yok Etme, vssadmin resize shadowstorage Yedek Engelleme, net stop Servis Durdurma, CreateRemoteThread Surec Enjeksiyonu | Kritik

RansomComponent ae355c32 PE32 x86 100KB. vssadmin Delete Shadows golge kopya yok etme. vssadmin resize shadowstorage yedek engelleme. net stop x5 servis durdurma. CreateRemoteThread enjeksiyonu.

阅读报告 →