MoVP 1.3 Desktops, heaps, and ransomware
Revision as of 20:26, 12 September 2012 by Eric.freyssinet (talk | contribs)
(Publication) Google search: [1]
MoVP 1.3 Desktops, heaps, and ransomware | |
---|---|
Botnet | Accdfisa, Tigger |
Malware | |
Botnet/malware group | |
Exploit kits | |
Services | |
Feature | |
Distribution vector | |
Target | |
Origin | |
Campaign | |
Operation/Working group | |
Vulnerability | |
CCProtocol | |
Date | 2012 / 12 septembre 2012 |
Editor/Conference | Volatility Labs |
Link | http://volatility-labs.blogspot.com.es/2012/09/movp-13-desktops-heaps-and-ransomware.html volatility-labs.blogspot.com.es (volatility-labs.blogspot.com.es Archive copy) |
Author | Michael Hale Ligh |
Type |
Abstract
“ The MoVP 1.3 plugin, named deskscan, enumerates desktops, desktop heap allocations, and associated threads. In the GUI landscape, a desktop is essentially a container for application windows and user interface objects. Malware utilizes desktops in various ways, from launching applications in alternate desktops (i.e. so the current logged-on user doesn't see) to ransomware that locks users out of their own desktop. We'll see some examples of both in this post.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR313, editor = {Volatility Labs}, author = {Michael Hale Ligh}, title = {MoVP 1.3 Desktops, heaps, and ransomware}, date = {Error: Invalid time.}, month = Error: Invalid time., year = {2012}, howpublished = {\url{http://volatility-labs.blogspot.com.es/2012/09/movp-13-desktops-heaps-and-ransomware.html volatility-labs.blogspot.com.es}}, }