RansomLord: A new weapon against Open Source Ransomware

Tomcat

Professional
Messages
2,383
Reputation
4
Reaction score
408
Points
83
This tool helps you protect yourself from 49 malware families.

RansomLord is an open source tool that automates the creation of PE files that are used to protect against ransomware before encrypting data.

The developer of RansomLord, known under the pseudonym hyp3rlinx, explained: "I created RansomLord to show that ransomware programs are not invulnerable, they have weaknesses, and their developers make mistakes and can write bad code just like everyone else."

Key features of the tool:
  • It uses DLL substitution tactics that are often used by cybercriminals.
  • Uses exploits to protect the network. This is a new strategy for fighting ransomware. First public disclosure: Lockbit MVID-2022-0572.
  • A tool for detecting malware vulnerabilities. The-m flag displays threats to vulnerable DLL files, which allows you to target specific threats that may be dangerous for your organization or industry.
  • It focuses on the tools of ransomware programs to identify their shortcomings, which can force attackers to rewrite the code to fix vulnerabilities.
  • Saves time and effort by filling in the knowledge gaps needed to create PE files to protect against ransomware.
  • Exposes twelve DLL files to protect against 49 ransomware families. One file cryptsp.dll It can protect against fifteen different ransomware programs, such as Yanluowang, Conti, LokiLocker, BlueSky, Haron, Thanos, AvosLocker, Meow, BabukLocker, Cerber, Clop, Play, LockerGoga, Jaff, and RuRansom.
  • Exploits a high malware vulnerability to this attack. Trojans and information-stealing programs can also be neutralized, such as Emotet MVID-2024-0684.
RansomLord is available for free on GitHub.
 
Top