App Review Emsisoft Anti Malware (default) vs Ransominator

[bayasdev]

Content source

https://www.youtube.com/watch?v=pbdO8Cjsmqk

@Fabian Wosar

 

[AYIZEB]

hello, very good video, it would be nice to try if you can, g-data and see its new behavior analyzer and deep ray.

 

[DDE_Server]

@Fabian Wosar

is this Zero day malware ??did you submitted it to virustotal ??is it detected by any engine ??

 

[bayasdev]

is this Zero day malware ??did you submitted it to virustotal ??is it detected by any engine ??

Only Cybereason detects it statically VirusTotal

hello, very good video, it would be nice to try if you can, g-data and see its new behavior analyzer and deep ray.

View attachment 238187

Since the trial wasn't properly registered (unknown error -random integer) so I don't think it's worth posting this on a new thread

 

[DDE_Server]

Only Cybereason detects it statically VirusTotal

i think it is detected by ML not signature it seems that from the name of detection it isnot by signature

what about Kaspersky ??

Since the trial wasn't properly registered (unknown error -random integer) so I don't think it's worth posting this on a new thread

 

[bayasdev]

what about Kaspersky ??

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

 

[Paul.R]

Can you try these 2 products: ESET IS and DR. Web Security Space ....I'm just curios.

 

[boombastik]

I believe that the free anti-ransomware appcheck and malwarebytes will detect it,because both of them have files modification behavior blocker.
-https://www.checkmal.com/product/appcheck/
-https://forums.malwarebytes.com/topic/258918-latest-version-of-mbarw-beta-v091956-build-330-released-23-april-2020/

 

[SeriousHoax]

Can you try these 2 products: ESET IS and DR. Web Security Space ....I'm just curios.

Forget ESET. I can tell even without testing that it won't be detected. Don't know about the Dr.Web but this won't be detected by almost any AV.

 

[MacDefender]

Forget ESET. I can tell even without testing that it won't be detected. Don't know about the Dr.Web but this won't be detected by almost any AV.

Yeah my first demo ransomware wasn't even LOLBin based, it was literally just a 5 line C# app that iterated through My Documents and used .NET's AES encryption to encrypt everything.

ESET was basically the only product other than Windows Defender (without CFA) that failed to detect this. I had a conversation with their engineers and they basically said detecting this kind of demoware is not something they care to add to their signatures -- they are focused on actual in the wild malware and their variants.

I can understand their position. Most of us do not encounter completely bona-fide ransomware.


Speaking of behavior blocking, one behavior that really impressed me was that recent versions of Norton seem to use their internet security component to monitor for large amounts of upload, and when that happens, it prompts you to run Norton Power Eraser.

Pure ransomware isn't as popular as it once was -- most forms of ransomware also try to upload some of your files so that their actors can threaten to release them if you don't pay the ransom. Detecting large amounts of upload traffic is a pretty easy way to flag that activity, forcing ransomware to become more complex in attempting to evade that kind of blocking.

To date I haven't noticed Emsisoft or F-Secure or other good behavior blockers try to incorporate network traffic into their behavior scoring. That was a pleasantly innovative idea from perhaps a company that not a lot of us expect to be on the forefront.

 

[bayasdev]

Forget ESET. I can tell even without testing that it won't be detected.

Ditto

App Review - ESET IS (Default) vs Ransominator

After recording I manually submitted the sample to ESET since I'm currently using EIS on my host 🙃 , I know it would have been manually blocked with interactive HIPS but it's just too annoying for most people.

malwaretips.com

 

[Durden]

I hope Emsisoft won't send a message to you telling you not to test their product.
It happened before!

 

[RmG152]

e anti-ransomware appcheck and malwarebytes will detect it,because both of them have files modification behavior blocker.
-https://www.checkmal.com/product/appcheck/

another vote for Appcheck

 

[iron2]

you can test appcheck?

 

[SeriousHoax]

Speaking of behavior blocking, one behavior that really impressed me was that recent versions of Norton seem to use their internet security component to monitor for large amounts of upload, and when that happens, it prompts you to run Norton Power Eraser.

Pure ransomware isn't as popular as it once was -- most forms of ransomware also try to upload some of your files so that their actors can threaten to release them if you don't pay the ransom. Detecting large amounts of upload traffic is a pretty easy way to flag that activity, forcing ransomware to become more complex in attempting to evade that kind of blocking.

This seems pretty clever from them. Is this part of their Intrusion Prevention module? I've seen that Norton along with normal signatures makes a lot of Intrusion signatures and sometimes it won't block a threat locally if heuristics, ML, cloud, SONAR failed properly detect something malicious but instead if it sees the sample doing something by inspecting its traffic then Norton blocks all connection activities of the sample. Norton doesn't seem to have a web shield built into their product that blocks malicious sites like other AVs instead it relies on these intrusion signatures and behaviors to block potential dangerous traffic.

 

[Fabian Wosar]

ESET was basically the only product other than Windows Defender (without CFA) that failed to detect this. I had a conversation with their engineers and they basically said detecting this kind of demoware is not something they care to add to their signatures -- they are focused on actual in the wild malware and their variants.

Same. We generally don't make changes unless it is genuine ransomware seen in the wild. This is what the ransomware landscape looks like at the moment:

For home users, the only relevant ransomware threat is STOP! and on occasion ransomware produced by either free or leaked generators (Xorist, Scarab being the main ones). STOP! in particular, will arrive bundled in pirated software setups. Pirates will usually just ignore their AV anyway, as a lot of cracks will also trigger alerts and warnings. None of these ransomware families will pose any issues to any AV out there.

For enterprise users, the ransomware is deployed after attackers already gained control over the network or system. The protection software used is completely irrelevant, as attackers will just deactivate any protection software by just clicking allow or by using the central management dashboards that are usually also used to deploy the ransomware to all endpoints at once seconds before the actual attack took place.

So the "use case" a lot of ransomware PoCs test doesn't even exist anymore, which is why a lot of security companies stopped caring about them. Paradoxically, detecting and preventing bots on the local network is far, far more important for preventing ransomware than actually preventing the ransomware, as the ransomware comes so late in the attack chain that at that point the security software is already compromised/deactivated.

I hope Emsisoft won't send a message to you telling you not to test their product.
It happened before!

It has never happened. They turned "either share the samples or don't bother testing as we can't do anything based on a video" into "they prohibit me to test them!" There is no way we could prevent anyone from testing our products in the first place, as in most countries reviews and criticism are covered by freedom of expression.

 

[MacDefender]

This seems pretty clever from them. Is this part of their Intrusion Prevention module? I've seen that Norton along with normal signatures makes a lot of Intrusion signatures and sometimes it won't block a threat locally if heuristics, ML, cloud, SONAR failed properly detect something malicious but instead if it sees the sample doing something by inspecting its traffic then Norton blocks all connection activities of the sample. Norton doesn't seem to have a web shield built into their product that blocks malicious sites like other AVs instead it relies on these intrusion signatures and behaviors to block potential dangerous traffic.

It looks like it's a part of the "reputations based" firewalling, under "Advanced Program Control". Seems like the firewall is extremely aggressive for poor reputation software, but for low-reputation (unknown) software it will trigger prompting alerts.

This is definitely a neat example of how Norton's layers of protection work together to do what each cannot. And it's not just intercepting and signature scanning network traffic like some other Internet Security products, Norton seems to assemble all of its components together to act intelligently on the whole picture.

 

[MacDefender]

Same. We generally don't make changes unless it is genuine ransomware seen in the wild. This is what the ransomware landscape looks like at the moment:

For home users, the only relevant ransomware threat is STOP! and on occasion ransomware produced by either free or leaked generators (Xorist, Scarab being the main ones). STOP! in particular, will arrive bundled in pirated software setups. Pirates will usually just ignore their AV anyway, as a lot of cracks will also trigger alerts and warnings. None of these ransomware families will pose any issues to any AV out there.

For enterprise users, the ransomware is deployed after attackers already gained control over the network or system. The protection software used is completely irrelevant, as attackers will just deactivate any protection software by just clicking allow or by using the central management dashboards that are usually also used to deploy the ransomware to all endpoints at once seconds before the actual attack took place.

So the "use case" a lot of ransomware PoCs test doesn't even exist anymore, which is why a lot of security companies stopped caring about them. Paradoxically, detecting and preventing bots on the local network is far, far more important for preventing ransomware than actually preventing the ransomware, as the ransomware comes so late in the attack chain that at that point the security software is already compromised/deactivated.

Yeah to be clear I don't think AVs should waste their time adding signatures to block PoCs. It's a waste of time because (1) it's not a real threat, and (2) there's a million ways I could change these PoCs to have the same consequence but a signature engine would not think it's similar.

On the topic of these ransomware PoCs, it's just interesting to see how different behavior blockers and whether or not they identify this behavior.

With regards to pirated software and bundled ransomware, unfortunately, I think that tends to be a problem that the industry has created. Too often harmless keygens, Windows Activators, and other piracy tools are detected with signatures saying they're generic trojans rather than software piracy tools. Windows Defender, unsurprisingly, is one of the worst offenders here. That's created an inherent distrust of AVs trying to warn users of piracy tools.

Everything you said makes a lot of sense about the changing landscape of threats, and ransomware PoCs are simply easy to produce versus simulating the complex entry vectors for the average malware. To me the main purpose of AV software itself is to serve as a combination of a way to sanity check things I downloaded as well as serve as the last line of defense if I was stupid enough to let something unsafe onto the system. But that might not be why the average enterprise customer or average PC user uses AVs.

 

[Fabian Wosar]

With regards to pirated software and bundled ransomware, unfortunately, I think that tends to be a problem that the industry has created. Too often harmless keygens, Windows Activators, and other piracy tools are detected with signatures saying they're generic trojans rather than software piracy tools. Windows Defender, unsurprisingly, is one of the worst offenders here. That's created an inherent distrust of AVs trying to warn users of piracy tools.

It's difficult, to be honest. There are two general cases:

1. Enterprises specifically requested their AV vendor to detect these things, as they consider them "malicious" and don't want their employees to use pirated software.
2. Keygens and cracks are often packed and obfuscated using various techniques that are also used by malware, which can trigger heuristics.

The first case will result in detections explicitly mentioning that it is a keygen or crack, not malware. It's often a separate group of detections and some AVs even had optional databases that contained signatures for these that you could turn on or off. The latter are the ones that may be detected as malware or trigger heuristics.

But on the other hand, if you did create a generic signature for example or some heuristic that detects all the variants of one malware family, but also some keygens, because the keygen author used the same obfuscator or copy and pasted some malware utility function into their keygen which your detection matches, would you sacrifice the signature just because of that? Or would you keep the detection and live with it, because warez is shady anyway.

Most vendors (we included) will opt for the latter. We won't fix a false positive that only occurs in "greyware".

 

[MacDefender]

But on the other hand, if you did create a generic signature for example or some heuristic that detects all the variants of one malware family, but also some keygens, because the keygen author used the same obfuscator or copy and pasted some malware utility function into their keygen which your detection matches, would you sacrifice the signature just because of that? Or would you keep the detection and live with it, because warez is shady anyway.

Most vendors (we included) will opt for the latter. We won't fix a false positive that only occurs in "greyware".

I totally understand that and I think that’s a sensible policy and motivation for an AV vendor to take.
The part I was trying to tug on was that it’s not just a matter of stupid users of pirated software tend to ignore their AV.... that is arguably a side effect from how AV signatures throughout history has flagged both Trojans and non-harmful piracy tools in much the same way. I think it’s entirely justifiable for both sides.
As someone who sometimes uses such tools, nothing has replaced manual malware analysis. There hasn’t been a single scanner I can send it through and feel confident about whether it’s malware or just a piracy tool.