Reply to thread

Message

<blockquote data-quote="1qay1qay" data-source="post: 513847" data-attributes="member: 51885">so Comodo FW with Autosandox enabled and with rule &quot;block ANY unknown/unrecognized&nbsp; from ANY location&quot; will save oure ass i suppose , but only util this attack&nbsp; is in file dropper form - what about file less form (generated in memory and hijack some allowed thread ) - anyone has any explanation or link to some whitepaper about that ?Regard Antivirus and signature detection based defense:Crypto / Ransomware is designed to elude detection of ALL stages of every Anti-Virus product.&nbsp; It is tested to guarantee entrance is undetectable! Every decent sample&nbsp; is unique and polymorphic, so signature detection is completely worthless. A delay in execution evades all sandbox technology.The ONLY action left for A/V is Behavioral Heuristics!That&#039;s it, NADA, there nothing else for A/V to do, except for URL blocking.And this evasion tactic its not from yesterday ... only difference is that today is fully automatic and its available to anyone with XXX eur ... <a href="https://community.rsa.com/community/products/security-analytics/blog/2014/03/26/the-malware-factory-and-massive-morphing-malware" target="_blank">The Malware Factory and Massive Morphing Malware | RSA Link</a></blockquote>

[QUOTE="1qay1qay, post: 513847, member: 51885"] so Comodo FW with Autosandox enabled and with rule "block ANY unknown/unrecognized from ANY location" will save oure ass i suppose , but only util this attack is in file dropper form - what about file less form (generated in memory and hijack some allowed thread ) - anyone has any explanation or link to some whitepaper about that ? Regard Antivirus and signature detection based defense: Crypto / Ransomware is designed to elude detection of ALL stages [B]of every Anti-Virus product[/B]. It is tested to guarantee entrance is undetectable! Every decent sample is unique and polymorphic, so signature detection is completely worthless. A delay in execution [B]evades all sandbox technology[/B]. The ONLY action left for A/V is Behavioral Heuristics! That's it, NADA, there nothing else for A/V to do, except for URL blocking. And this evasion tactic its not from yesterday ... only difference is that today is fully automatic and its available to anyone with XXX eur ... [URL='https://community.rsa.com/community/products/security-analytics/blog/2014/03/26/the-malware-factory-and-massive-morphing-malware']The Malware Factory and Massive Morphing Malware | RSA Link[/URL] [/QUOTE]

Verification