5 ms·
FunctionStomping – A new shellcode injection technique
- greenn 5y agoMalware / ransomware / security products have been doing this for many years, especially to Windows modules like kernel32.dll and ntdll.dll.
- mmastrac 5y agoThis is a common firmware modification trick, but interesting to see in a dynamic way.
- cryptonector 5y agoDoesn't seem like anything really new.
- mockingbirdy 5y agoI've used nearly the same code for years with a trampoline function (JMP instruction instead of simply writing the code right there), so not too sure about it being a new technique. In my opinion, CreateRemoteThread is the function that usually triggers AVs and injecting code into processes is the suspicious part.