Serious Discussion Are antiviruses unimportant?

Dr. Wells said:
If behavioral need internet, why it's behavioral protecton?
Click to expand...
The fact that it is “behavioural” doesn’t have anything to do with the way it operates. It needs internet because some machine learning models are impossible to run on your machine, they would take days, weeks, months.

If you don’t understand the principles of protection, you should abstain from doing everything that you do.
Dr. Wells said:
i think you dont tell behavior, you telling heuristic.
Click to expand...
They work the same way. One works with behaviour extracted through partial emulation, the other one works with behavioural features observed at runtime.

Also, try consolidating your replies in one post.
Don’t rush to reply, read and understand first.
 
  • Like
  • +Reputation
Reactions: Parkinsond, simmerskool, Andy Ful and 4 others
Trident said:
The fact that it is “behavioural” doesn’t have anything to do with the way it operates. It needs internet because some machine learning models are impossible to run on your machine, they would take days, weeks, months.
Click to expand...
I also tested it with system watcher, internet was open and ksn was also connected but it did not block. But it's not recorded, if you want me to test sample with all modules and open internet, i will record it and send you after @Shadowra and @Khushal told me they tested my sample.

Another things with KSN or alternative of it is that they dont get digitally signed files, that's why if a virus really strongly fudded and signed, then KSN-like cloud technologies would ignore it.



i think offline behavioral protection should able to stop this virus, it's not complex. it's simple.
 
  • Like
Reactions: Parkinsond, zidong and Khushal
Dr. Wells said:
Another things with KSN or alternative of it is that they dont get digitally signed files, that's why if a virus really strongly fudded and signed, then KSN-like cloud technologies would ignore it.
Click to expand...
Different solutions have different ways of dealing with signed malware. Some may be oblivious to signed malware, others may need more indicators than just the digital signature. Kaspersky is not one of the oblivious, neither is Avast. Avast very quickly makes the digital signature the actual reason for detection.
 
  • Like
  • +Reputation
Reactions: Parkinsond, simmerskool, Nevi and 3 others
Trident said:
Different solutions have different ways of dealing with signed malware. Some may be oblivious to signed malware, others may need more indicators than just the digital signature. Kaspersky is not one of the oblivious, neither is Avast. Avast very quickly makes the digital signature the actual reason for detection.
Click to expand...
Maybe i can test AVG tonight with open internet. I worry it.
 
  • Like
Reactions: Khushal and Trident
Here are the tests!

Internet was disabled during the test.

KFree1.png
KFree2.png
KFree3.png

Kaspersky did not block the attack.
I don't think the Ransomware encrypts the data because the files are lost forever...
It's more like a Wipper...

Bitdefender.png
Bitdefender blocked it on extraction by the anti-malware engine with one detection.
 
  • +Reputation
  • Like
Reactions: Parkinsond, Behold Eck, simmerskool and 8 others
  • Like
Reactions: simmerskool, Divine_Barakah, Shadowra and 1 other person
Khushal said:
it does encrypt data, i agree i am doing forensics.
Click to expand...
It compromises the integrity of information is the right way to say it then, since you are doing forensics.
It is malware and it must be detected.
Dr. Wells said:
@Trident Bro i just tested Kaspersky Premium with all module and connected to network and it didnot block, im uploading video.
Click to expand...
Kaspersky Premium can be tweaked to not allow the execution of this file. Without the tweak, seems like there is no detection from the standard modules.
 
  • Like
Reactions: simmerskool, Nevi, roger_m and 4 others
Trident said:
It compromises the integrity of information is the right way to say it then, since you are doing forensics.
It is malware and it must be detected.

Kaspersky Premium can be tweaked to not allow the execution of this file. Without the tweak, seems like there is no detection from the standard modules.
Click to expand...
Yeah i have often submitted Kaspersky such samples and their analysts always hesitate to add heuristics for Kryptik/Crypt Samples. Albeit i do think that Kaspersky might behave differently on a real machine as quoted multiple times by their experts.
 
  • Like
Reactions: simmerskool and Divine_Barakah

You may also like...