I said "almost everything", because in the cases of the others 2 signed exes, VS blocked something but in the case of 1st sample I did not get any warning from VS, and got system encrypted...
.. I imagine most people are curious how well VS does when set to the least aggressive modes and security postures, but if this is not the case, maybe users can suggest how they would like to see VS configured while testing. Thank you guys for testing! If anyone testing needs a Pro license, please PM me.
Yeah, I hear youEven with relaxed mode the file has to be labeled from whitelist cloud as safe. Atleast thats what the "relaxed mode" discription says. And since whitelist cloud should only allow known safe files im curious what happened
. WLC is super cautious and conservative, but it will never be absolutely perfect, especially with valid and verified signed files that bypass SS. And remember, WLC is a work in progress .
If it were you would have retired to Bali after the $$$$$$$$$$$$$$$$$ buyout by MegaCorp!
Yeah, I would sell all of my computers and tech and run a nice little hot dog stand on the beachIf it were you would have retired to Bali after the $$$$$$$$$$$$$$$$$ buyout by MegaCorp!
.
Yeah, tretg45 was signed with an EV cert, and overcoming this with static detection would be extremely difficult. The good news is that EV signed malware is extremely uncommon because no one is going to waste the money on an EV cert to sign malware, especially when the cert is going to be terminated and everyone will know exactly who created the malware. After researching the file, I am guessing this was some kind of POC malware or something created and signed by OOO Inversum, and apparently they created at least two other EV signed malware samples. Do you guys know anything else about this file? Also, do you guys have any other EV signed malware you can try? Thank you!
Something is not right, when VS is ON / Aggressive it should block tretg45.exe. Did you reset the whitelist between tests?Hum I tested in Always On with Agressive and also bypassed
This is odd, here is what I am seeing on my end. The pink items were detected as Not Safe by WLC, so they should have been blocked, even if VS was on AutoPilot / Relaxed. Either way I would like to figure this out so that we can ensure the Relaxed security posture code segment is working properly. I have not been able to find a sample for eddr45.exe, can someone please pm me one? Thank you!Just to make another point more clear to everyone who may didn't know or seen on this test:
https://malwaretips.com/threads/age...-sload-trickbot-11-12-2020.105652/post-918298
eddr45.exe #Nempty Ransomware (signed) was the first bypass on VoodoShield: some files got encrypted... but it's signed without "Extended Validation Certificate"
I reviewed the VS code and figured out why eddr45.exe was allowed on AutoPilot. Basically, there is an old hardcoded rule in VS when it is on AutoPilot where if the sig is verified and VoodooAi is < 0.3333, then it will be allowed... this is another bug left over from when we replaced VT with WLC. Thank you guys for finding this, I am fixing it right now!Just to make another point more clear to everyone who may didn't know or seen on this test:
https://malwaretips.com/threads/age...-sload-trickbot-11-12-2020.105652/post-918298
eddr45.exe #Nempty Ransomware (signed) was the first bypass on VoodoShield: some files got encrypted... but it's signed without "Extended Validation Certificate"
Very cool, thank you for letting me know! I know what you mean, odd things happen when testing. Either way, I am super happy that you guys are finding things for me to fix... I was not kidding when I was saying that VS was overdue for a good workoutOk, I re tested eddr45.exe: Always On + Aggressive:
I started the clean-snap shot, changed to On + Aggressive and Reset WhiteList, I had to unlock Process Explorer and TCPView because VS blocked them on execution
View attachment 250980
I don't know why, but the other day I did the same and VS did not block it, I even disabled some "Allow settings" trying to get VS even more strict, but in all got the same result, maybe the VM was unstable or VS, don't know
, especially with all of the changes that have been made recently (especially the VT to WLC conversion). Thanks again!
