To check URL against Avast?Norton database, I have to submit it to Norton safeweb.i did send the link earlier
Avast database (representing Norton too) is included for file check, but not for URL check on VT!
To check URL against Avast?Norton database, I have to submit it to Norton safeweb.i did send the link earlier
no no i meant i shared safeweb results screenshot was not needed.To check URL against Avast?Norton database, I have to submit it to Norton safeweb.
Avast database (representing Norton too) is included for file check, but not for URL check on VT!
I was posting the screenshot during the exact moment you were posting the link; I found both in front of me at the same momentno no i meant i shared safeweb results screenshot was not needed.
SAC/WDAC is light on my 2012 PC; I do not know if as efficient as AppGuard or not.By the way AppGuard does seem to slow down my 2020 laptop.
If you can't beat them, copy them. HeheI think they are copying from Kaspersky.
The previous sample was first detected by Symantec also.
Then I submitted to Kaspersky; it was detected, than added to VT.
Later QuickHeal detected it also on VT.
Fake it, until you make itIf you can't beat them, copy them. Hehe
AG has it's own different logic. It is not reputation based nor signature based. If it runs from a user writable dir it is blocked. If a guarded application like Office or Adobe PDF tries to run it and it attempts messing with memory of another app it is blocked, attempts messing with registry it is blocked. If it uses OS utils the wrong way it is blocked. I am still evaluating it so i don't have all the answers. Hard to say if it is efficient, I does things differently, can't compare apple to orange. Shadowra did a test and it blocked every single one.I do not know if as efficient as AppGuard or not.
Looks very aggressive; the decision depends to what extenst it can impair the usability experience.AG has it's own different logic. It is not reputation based nor signature based. If it runs from a user writable dir it is blocked. If a guarded application like Office or Adobe PDF tries to run it and it attempts messing with memory of another app it is blocked, attempts messing with registry it is blocked. If it uses OS utils the wrong way it is blocked. I am still evaluating it so i don't have all the answers. Hard to say if it is efficient, I does things differently, can't compare apple to orange. Shadowra did a test and it blocked every single one.
AG guards applications and stops them from doing harmful things. It does not protect the guarded app itself. The guarded app is stopped from doing harmful things. ChatGPT explains it as stopping the chain at the source. Office and PDF reads untrusted docx and untrusted PDFs, so something has to stop them from being weaponized. If they spawn a child process, that child process is similarly 'contained' - no memory injection, no registry modifcation, no calling OS utils in the wrong way.the decision depends to what extenst it can impair the usability experience.
MD ASR rules have a subset for such a purpose.Office and PDF reads untrusted docx and untrusted PDFs, so something has to stop them from being weaponized
Don't think so.typical indian mindset of copying russians as they have done in defense.
No! K7 did not copying from Kaspersky.I think they are copying from Kaspersky.
The previous sample was first detected by Symantec also.
Then I submitted to Kaspersky; it was detected, than added to VT.
Later QuickHeal detected it also on VT.
Creates a process in suspended mode (likely for process injection)
details"powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\msiexec.exe" /i "%TEMP%\s1480922090.msi" /qn /norestart" - (UID: 00000000-00005524)
Loads the task scheduler interface DLL
details"Crisp.exe" loaded module "%WINDIR%\SysWOW64\mstask.dll" at 729F0000
Writes data to a remote process
details"powershell.exe" wrote 000011C0 bytes to a remote process "%WINDIR%\System32\msiexec.exe" (Handle: 3192)
"powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 3192)
Uses network protocols on unusual ports
detailsTCP traffic to 178.17.59.26 on port 5506
TCP traffic to 91.84.123.231 on port 3333
TCP traffic to 91.84.123.231 on port 3334
Checks for files associated with bitcoin mining software
details"PlaneV128.exe" opened file "%APPDATA%\Bitcoin"
"PlaneV128.exe" opened file "%LOCALAPPDATA%\Bitcoin"
Tries to steal Crypto currency wallets information (file access)
details"PlaneV128.exe" trying to touch file "%LOCALAPPDATA%\Coinomi\Coinomi\wallets"
"PlaneV128.exe" trying to touch file "%APPDATA%\Electrum\wallets"
"PlaneV128.exe" trying to touch file "%APPDATA%\Exodus\exodus.wallet"
Tries to steal browser sensitive information (file access)
details"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\compatibility.ini"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\CocCoc\Browser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Tencent\QQBrowser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Slimjet\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Vivaldi\User Data"
Executes WMI queries in order to detect local security applications
details"PlaneV128.exe" issued a query "SELECT * FROM AntiVirusProduct"
A third one not detected even by Symantec, but only by behavioral analysis of VT and sandbox of HA.
View attachment 295365
Ip is already down
but other communicating files are already detected by world class AVs: