086. Detecting Ransomware Affiliate's Toolkit: IObit Unlocker
Hello everyone! Let's keep looking inside a ransomware affiliate's toolkit. This time it's IObit Unlocker . The adversary leverages this tool to unlock files and folders that are locked by other processes. For example, the tool is a part of RansomHub arsenal. As always, we can look at metadata or, if the adversary installed it, look for corresponding folders: event_type: "prorcesscreatewin" AND (proc_file_productname: "IObit Unlocker" OR proc_file_path: "IObit") You can look at the sample yourself and find more detection opportunities, of course! See you tomorrow!