App Review Emsisoft vs. Ransomware - Double Feature (Juan Diaz)

[Der.Reisende]

Content source

https://youtu.be/EQG9WiYmHhg

HUB Thread for #FCrypt Ransomware:

https://malwaretips.com/threads/fcrypt-ransomware.90430/#post-797420

 

[Wraith]

It seems that Emsisoft doesn't monitor the child processes if it's a trusted process. Fcrypt used cmd to encrypt the files and since cmd is a trusted windows component, the BB ignored it's actions. I wonder how OSArmor would fare in such a situation.

 

[bribon77]

Big Emsisoft flaw. You must correct that.

 

[Arequire]

Big Emsisoft flaw. You must correct that.

It's being worked on:

We are currently reworking the way trust works in EAM, so it assigns trust based on a trust-chain. That means, GPG may be trusted when it is started by a trusted process, but not if it is started by an unknown or untrusted process.

There is no ETA yet for when this change will roll out ...