search

Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
944 stars 122 forks source link

Added logger file, patched /e arg #19

Closed Omodaka9375 closed 3 years ago

Omodaka9375 commented 3 years ago

Added safe logging functionality. Made it fast for access and reading using a static file pointer (otherwise it's exponentially slower). Checks for file 'Raccine_log.txt' in C:\Windows\ dir, if none exist it creates it - if file exists it appends to it. Logs formated ctime, processID, malicious command, and a flag. intercepted, terminated, or whitelisted.

eg: Fri Oct 16 19:17:02 2020 =>pid:1328=>bcdedit.exe/set{default}_recoveryenabledno=> Intercepted =>pid:8496=>bcdedit.exe/set{default}_recoveryenabledno=> Whitelisted

Applied patch for encoded command '/e' in OR condition for '-e' https://twitter.com/FuzzySec/status/1317118979639566336

Neo23x0 commented 3 years ago

I've changed the log format and location.

Screenshot 2020-10-17 110641

Omodaka9375 commented 3 years ago

Looks better visually definitely 👍