Reply to thread

Message

<blockquote data-quote="ForgottenSeer 89360" data-source="post: 920588">Eset has implemented heuristics against certain types of obfuscated scripts, detecting them as MSIL.Kryptik or something of this sort. This explains both the fileless Tesla implementation, as well as Emotet identification (since you are saying 2/69 on VT I understand it&#039;s trojanized document). I am saying *some* as there are types of obfuscation such as compression that weren&#039;t covered when I tested it.I have also seen it many times detecting various 0-days I have discovered, together with Kaspersky and I have seen it miss some. More frequently the former.You can&#039;t call their protection weak or abysmal and it is definitely boosted from before, but there is no behavioural blocking. Although it exists as a component in settings + ransomware protection &quot;extension&quot; I don&#039;t believe anyone ever saw these in action. Pre-execution analyses detects most ransomware(s) and even their notes, bit it&#039;s not impossible to evade. There are unfortunately many ways to evade static and dynamic analyses. My C++ ransomware that iterates through folders via the boost library and not the Windows APIs was a miss. They only utilise reputation as a minor indicator (unlike Kaspersky&#039;s Application Control, Norton Insight or Avast hardened mode against executables) so they lose a point there as well. I believe they will look to improve these areas in the next version.</blockquote>

[QUOTE="ForgottenSeer 89360, post: 920588"] Eset has implemented heuristics against certain types of obfuscated scripts, detecting them as MSIL.Kryptik or something of this sort. This explains both the fileless Tesla implementation, as well as Emotet identification (since you are saying 2/69 on VT I understand it's trojanized document). I am saying *some* as there are types of obfuscation such as compression that weren't covered when I tested it. I have also seen it many times detecting various 0-days I have discovered, together with Kaspersky and I have seen it miss some. More frequently the former. You can't call their protection weak or abysmal and it is definitely boosted from before, but there is no behavioural blocking. Although it exists as a component in settings + ransomware protection "extension" I don't believe anyone ever saw these in action. Pre-execution analyses detects most ransomware(s) and even their notes, bit it's not impossible to evade. There are unfortunately many ways to evade static and dynamic analyses. My C++ ransomware that iterates through folders via the boost library and not the Windows APIs was a miss. They only utilise reputation as a minor indicator (unlike Kaspersky's Application Control, Norton Insight or Avast hardened mode against executables) so they lose a point there as well. I believe they will look to improve these areas in the next version. [/QUOTE]

Verification