Eric.freyssinet: Text replacement - " blogs.avg.com" to ""

2015-08-05T20:12:08Z

Text replacement - " blogs.avg.com" to ""

← Older revision		Revision as of 20:12, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://blogs.avg.com/news-threats/attention-data-hardrive-encrypted ~~blogs.avg.com~~		\|Link=http://blogs.avg.com/news-threats/attention-data-hardrive-encrypted
	\|Author=Tomas Prochazka, Michal Cebak,		\|Author=Tomas Prochazka, Michal Cebak,
	\|NomRevue=AVG Official Blogs		\|NomRevue=AVG Official Blogs

Eric.freyssinet: 1 revision imported

2015-02-07T14:29:30Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blogs.avg.com/news-threats/attention-data-hardrive-encrypted blogs.avg.com
|Author=Tomas Prochazka, Michal Cebak,
|NomRevue=AVG Official Blogs
|Date=2013-01-30
|Editor=AVG
|Year=2013
|ISBN=
|Page=
|Abstract=We have seen various mutations of the well known “police ransomware” Trojan throughout the year. Despite the threatening and convincing message it carries, most people probably choose to avoid the “fine” by simply removing the malware. Well, the following ransomware is little bit different.

After the sample is executed and initial emulators and virtual machine detections are passed, the process spawns either ctfmon.exe or svchost.exe (randomly chosen) where it injects its own code. This injected system process then executes the copy of the sample from %TEMP% folder, which creates another ctfmon.exe or svchost.exe child process with injected code and finally starts some interesting actions.
|Botnet=Matsnu,
|Malware=,
|ExploitKit=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

Attention! All data on your hardrive is encrypted - Revision history

Eric.freyssinet: Text replacement - " blogs.avg.com" to ""

Eric.freyssinet: 1 revision imported