Posted by malvuln on Feb 23

Discovery / credits: Malvuln – malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/a229acff4e0605ad24eaf3d9c44fdb1b.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.DarkKomet.irv
Vulnerability: Insecure Permissions
Description: DarkKomet.irv creates an insecure dir named “Windupdt” under
c: drive, granting change (C) permissions to authenticated user group.
Standard users can rename…
– Read More – Full Disclosure