Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 1049687" data-attributes="member: 7463">One must not clump RAT’s and Stealers together. A RAT (Remote Access Trojan) must first connect out to malware Command and then be acted upon by the person on the other end. A stealer is much more widespread (especially now, where they are EVERYWHERE) and insidious as they will either collect and send sensitive browser data (like logins and passwords- some specifically will only go after financial thingies), then just send them out to Command without any need for the Blackhat to connect to the victim’s computer herself. Also recently popular are stealers that will package the contents of the Documents and Photos folders for transmission outward. Neither of these mechanisms will lead to an optimal result.As long as the malware itself is known and the precise mechanism of data theft is also known, both traditional and non-traditional anti-malware applications should have no issue in preventing infection. However, for anything novel it can be that both the malware file itself as well as the remote malware Command IP are both unknown; in this case you would be screwed.Best is a product that would both contain unknown files even if signed (and not previously vetted) as well as blocking any outbound connection of that file by default. A stealer can’t steal if it can’t communicate. But in the absence of installing such an application, in general an Outbound altering Firewall is essential in the extreme.Finally, it is important to note that Ransomware for the most part is a thing of the past. Stealers are much more lucrative and thus a whole lot more popular.</blockquote>

[QUOTE="cruelsister, post: 1049687, member: 7463"] One must not clump RAT’s and Stealers together. A RAT (Remote Access Trojan) must first connect out to malware Command and then be acted upon by the person on the other end. A stealer is much more widespread (especially now, where they are EVERYWHERE) and insidious as they will either collect and send sensitive browser data (like logins and passwords- some specifically will only go after financial thingies), then just send them out to Command without any need for the Blackhat to connect to the victim’s computer herself. Also recently popular are stealers that will package the contents of the Documents and Photos folders for transmission outward. Neither of these mechanisms will lead to an optimal result. As long as the malware itself is known and the precise mechanism of data theft is also known, both traditional and non-traditional anti-malware applications should have no issue in preventing infection. However, for anything novel it can be that both the malware file itself as well as the remote malware Command IP are both unknown; in this case you would be screwed. Best is a product that would both contain unknown files even if signed (and not previously vetted) as well as blocking any outbound connection of that file by default. A stealer can’t steal if it can’t communicate. But in the absence of installing such an application, in general an Outbound altering Firewall is essential in the extreme. Finally, it is important to note that Ransomware for the most part is a thing of the past. Stealers are much more lucrative and thus a whole lot more popular. [/QUOTE]

Verification