Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1116469" data-attributes="member: 32260">Normally, I would say that this particular malware is nothing unusual or dangerous because it is a kind of POC (based on an in-the-wild sample). Unfortunately, my experience with Comodo&#039;s detection of DLLs is very pessimistic, especially for DLLs uploaded to Malware Bazaar. To be honest, Comodo can contain many in-the-wild attacks with DLLs (mainly via Script Analysis). The problem can arise when the attack uses a Trusted and benign EXE file (like in the video) that loads a malicious DLL.The problem with shortcuts mentioned in the video is mainly solved by Comodo via Auto-containment and Script Analysis. So, in this case, @cruelsiter was right. Comodo does not block shortcuts, but it can efficiently contain the execution of processes triggered via shortcuts. The problem is mainly when the shortcut triggers a Trusted and benign file (not restricted by Script Analysis) that loads a malicious DLL. Such attacks were rarely reported in the wild.In my opinion, the problem presented in the video is a potential weak point of Comodo. However, there are no reports that this attack vector was intentionally used in the wild against the Comodo/Xcitium customers. As [USER=109212]@vitao[/USER] mentioned in the video, the current protection of Comodo is one of the best. Any top AV has some weaknesses.</blockquote>

[QUOTE="Andy Ful, post: 1116469, member: 32260"] Normally, I would say that this particular malware is nothing unusual or dangerous because it is a kind of POC (based on an in-the-wild sample). Unfortunately, my experience with Comodo's detection of DLLs is very pessimistic, especially for DLLs uploaded to Malware Bazaar. To be honest, Comodo can contain many in-the-wild attacks with DLLs (mainly via Script Analysis). The problem can arise when the attack uses a Trusted and benign EXE file (like in the video) that loads a malicious DLL. The problem with shortcuts mentioned in the video is mainly solved by Comodo via Auto-containment and Script Analysis. So, in this case, @cruelsiter was right. Comodo does not block shortcuts, but it can efficiently contain the execution of processes triggered via shortcuts. The problem is mainly when the shortcut triggers a Trusted and benign file (not restricted by Script Analysis) that loads a malicious DLL. Such attacks were rarely reported in the wild. In my opinion, the problem presented in the video is a potential weak point of Comodo. However, there are no reports that this attack vector was intentionally used in the wild against the Comodo/Xcitium customers. As [USER=109212]@vitao[/USER] mentioned in the video, the current protection of Comodo is one of the best. Any top AV has some weaknesses. [/QUOTE]

Verification