App Review Huorong Internet Security v6.0.7.12 (Modified Setting)

[janx]

Content source

https://www.youtube.com/embed/Ewn4wongJs0?si=2piJ5SI7bl-cydFZ

Huorong Internet Security 6.0.7.12 Malware Test (Modified Settings)​

Note:​

I’ve modified several settings to improve detection rates. In my opinion, these should be the default settings, as the stock configuration is too lenient.

User Interface and Tools​

Surprisingly good for a Chinese antivirus other av usually include bundled junkware, excessive pop-ups, and cluttered layouts. however, huorong is clean and easy to navigate.
The included tools, such as SecAnalysis (which feels like a combination of *ProcMon* and *Comodo KillSwitch*), are also genuinely useful for advanced users.

Scan Test​

Files Tested: 332
Undetected: 88
Detection Rate: 73.49%

Overall detection is decent. With some tuning, it performs much better than the default configuration. Also I haven't turn some feature to maximum yet might test it later.

Execution Test​

Files Executed: 33
Immediately Blocked: 11
Immediate Block Rate: 33.33%

Note:
Only files that were instantly blocked upon execution are counted here. Detections triggered later (e.g. by HIPS, behavior analysis, or memory protection) are not included in this percentage.
However, these advanced layers (HIPS, behavior-based, and memory protection) successfully stopped quite a number of the remaining samples.

Second Opinion​

After testing, 2 samples remained active in memory.

HitmanPro Detections: 1
Kaspersky virus removal tool: 0

Analysis:
The first file appeared inactive it performed multiple registry reads, create prefetch and attempted a TCP connection to a server that returned a 503 error.
The second file also read several registry keys but didn’t seem to perform any noticeable malicious activity.

Summary​

With proper configuration, Huorong performs reasonably well. Its clean UI, powerful built-in tools, and Behavior detection layered that works.
But the default settings is quite bad out of the box with memory protection enable but only for logging, and the real-time blocking could be more aggressive out of the box and using the advanced heuristic scanning in real-time scanning would improve protection significantly, though it may increase false positives, which is understandable.

 

[Bot]

Huorong Internet Security 6.0.7.12 Malware Test (Modified Settings)​

Note:​

I’ve modified several settings to improve detection rates. In my opinion, these should be the default settings, as the stock configuration is too lenient.

User Interface and Tools​

Surprisingly good for a Chinese antivirus other av usually include bundled junkware, excessive pop-ups, and cluttered layouts. however, huorong is clean and easy to navigate.
The included tools, such as SecAnalysis (which feels like a combination of *ProcMon* and *Comodo KillSwitch*), are also genuinely useful for advanced users.

Scan Test​

Files Tested: 332
Undetected: 88
Detection Rate: 73.49%

Overall detection is decent. With some tuning, it performs much better than the default configuration. Also I haven't turn some feature to maximum yet might test it later.

Execution Test​

Files Executed: 33
Immediately Blocked: 11
Immediate Block Rate: 33.33%

Note:
Only files that were instantly blocked upon execution are counted here. Detections triggered later (e.g. by HIPS, behavior analysis, or memory protection) are not included in this percentage.
However, these advanced layers (HIPS, behavior-based, and memory protection) successfully stopped quite a number of the remaining samples.

Second Opinion​

After testing, 2 samples remained active in memory.

HitmanPro Detections: 1
Kaspersky virus removal tool: 0

Analysis:
The first file appeared inactive it performed multiple registry reads, create prefetch and attempted a TCP connection to a server that returned a 503 error.
The second file also read several registry keys but didn’t seem to perform any noticeable malicious activity.

Summary​

With proper configuration, Huorong performs reasonably well. Its clean UI, powerful built-in tools, and Behavior detection layered that works.
But the default settings is quite bad out of the box with memory protection enable but only for logging, and the real-time blocking could be more aggressive out of the box and using the advanced heuristic scanning in real-time scanning would improve protection significantly, though it may increase false positives, which is understandable.

Thanks for the detailed write-up and video, @janx! Huorong isn't one of the more commonly discussed AVs here on MalwareTips, so it's great to see some fresh testing on it—especially with your tweaks to bump up the detection rates. I agree that stock configs on many AVs can be too conservative; it's always a balance between usability and security.

A few thoughts/questions:

• Did you notice any significant performance impact after enabling those advanced heuristics or maxing out other features? Huorong's reputation for being lightweight is a plus, but aggressive settings might change that.
• The built-in tools like SecAnalysis sound intriguing—any chance you could share a quick screenshot or more details on how it compares to ProcMon in practice? (If it's as good as you say, it might sway some users away from bloated suites.)
• On the execution test: 33% immediate blocks isn't stellar, but the layered defenses picking up the slack is promising. Have you compared this to something like Comodo or ESET in a similar setup?

Overall, solid test—looking forward to any follow-ups if you crank those settings higher. Keep 'em coming!

 

[stonjean633]

Huorong aint bad. It just has limitations. What I observe was it's low ram usage but the update seems only once daily.
I like that it's available natively on Windows on ARM. Some well known AV don't have it native for WoA.

 

[Digmor Crusher]

Execution Test​

Files Executed: 33
Immediately Blocked: 11
Immediate Block Rate: 33.33%

Scan Test​

Files Tested: 332
Undetected: 88
Detection Rate: 73.49%

I would consider these results as poor.

 

[janx]

I would consider these results as poor.

Fair, consider Post-execution detection rate is really bad.

 

[Trident]

Fair, consider Post-execution detection rate is really bad.

I’m not a fan of products that heavily rely on HIPS…

 

[stonjean633]

For Realtime, I don't recommend this; go with the major players.
But for an extra scanner with every settings off, this is ok.
GPU acceleration makes the scan faster too.

 

[Trident]

For Realtime, I don't recommend this; go with the major players.
But for an extra scanner with every settings off, this is ok.
GPU acceleration makes the scan faster too.

Seems like they've built a very modern engine

 

[stonjean633]

Seems like they've built a very modern engine

Ya it seems the Cobra Engine is modern and will run files in the H-VM. I experience false positives thou from windows files and other AV signatures when I ran a Huorong Full Scan.

 

[oldschool]

@Der.Reisende used to play with this AV. It never performed well in tests.

 

[Allen Steve]

A significant number of users with low-end computers resisted upgrading to version 6.0, as it consumes more resources than version 5.0. The huorong official team likely considered this aspect, making the default settings of huorong 6.0 relatively closer to those of version 5.0.
However, users still frequently report that version 6.0 experiences lag or high memory usage, and the official response is always to reduce monitoring levels...
Updating once a day still draws criticism, let alone the fact that the official policy delays startup updates by 30 minutes...
However, you can add its upgrade program to the task scheduler with the parameter "-a" to enable automatic updates upon system login.

 

[Trident]

A significant number of users with low-end computers resisted upgrading to version 6.0, as it consumes more resources than version 5.0. The huorong official team likely considered this aspect, making the default settings of huorong 6.0 relatively closer to those of version 5.0.
However, users still frequently report that version 6.0 experiences lag or high memory usage, and the official response is always to reduce monitoring levels...
Updating once a day still draws criticism, let alone the fact that the official policy delays startup updates by 30 minutes...
However, you can add its upgrade program to the task scheduler with the parameter "-a" to enable automatic updates upon system startup.

Can you explain a bit more about the included engines?

 

[Allen Steve]

Can you explain a bit more about the included engines?

engines？Huorong only has its own engine, no other engines. Am I misunderstanding?

 

[Trident]

engines？Huorong only has its own engine, no other engines. Am I misunderstanding?

Yes, I am asking what proprietary engines are they using and what these engines are based on (cloud, AI, yara rules, etc).

 

[Allen Steve]

Yes, I am asking what proprietary engines are they using and what these engines are based on (cloud, AI, yara rules, etc).

Without cloud, local feature engine, virtual sandbox heuristic (HVM), AI engine not involved in monitoring (advanced heuristic scanning), I don't know much about it.。

 

[Trident]

Without cloud, local feature engine, virtual sandbox heuristic (HVM), AI engine not involved in monitoring (advanced heuristic scanning), I don't know much about it.。

Yeah, sounds a bit insufficient.

 

[Allen Steve]

Yeah, sounds a bit insufficient.

This is the engine description released by Huorong. You can translate it with a screenshot：

https://huorong.cn/Public/Uploads/uploadfile/files/20241218/huorongfanbingduyinqingjianjie.pdf

Huorong is free and cannot make money in the personal market. It relies on selling the enterprise version to make money, while the enterprise does not have such high requirements...

 

[Trident]

This is the engine description released by Huorong. You can translate it with a screenshot：

https://huorong.cn/Public/Uploads/uploadfile/files/20241218/huorongfanbingduyinqingjianjie.pdf

According to the document, it uses both cloud and machine learning.

It also uses hashing - full hashinf, ssdeep and tlsh.

Anti-virus engine components

An antivirus engine that meets the above definition generally consists of at least the following modules:

1. Data format identification and analysis module

Responsible for identifying and analyzing the format of the scanned object and providing sufficient format-related information to the scanning core;

2. Antivirus signature database

a) Local feature library;

b) Cloud feature library;

3. Scan core

Responsible for the scanning logic of the entire antivirus engine. Different scanning technologies are also scheduled by the scanning core;

Anti-virus engine scanning technology

1. Feature Scan

a) Full-text hash;

4/25Machine Translated by Google

b) Segment hashing;

c) Locality Sensitive Hashing;

d) Key data

i. Identify malicious code by extracting key code or data fragments from the malicious code;

ii. Key data characterization and methods vary, but will include at least two types of information, namely,

Bit method and matching method. For example, between file offset 0x100 and 0x200, search

Find the sequence AABBCCDDEEFF;

2. Heuristic Scanning

a) Static heuristic scanning: By extracting the static information of the object to be scanned, the maliciousness is evaluated through the heuristic algorithm.

intention;

b) Dynamic heuristic scanning: By extracting dynamic information of the object to be scanned (for example,

behavior), and evaluate its maliciousness through heuristic algorithms;

3. Dynamic Behavior Analysis

When the anti-virus engine scans, it dynamically executes the object to be scanned in the virtual sandbox and captures its dynamic

Behavior and assess its maliciousness through behavioral patterns or heuristic algorithms;

4. Statistical classification based on big data

a) Support Vector Machine (SVM);

b) Decision tree;

c) Neural Networks;

 

[Allen Steve]

According to the document, it uses both cloud and machine learning.

It also uses hashing - full hashinf, ssdeep and tlsh.

no，no，no， He's just introducing what antivirus engines are available in the market here. You have to scroll down to see what the Huorong engine has...

 

[Trident]

no，no，no， He's just introducing what antivirus engines are available in the market here. You have to scroll down to see what the Huorong engine has...

Oh I see... yeah, it all seems to be based on the Cobra/HVM engine... not amazing...

Dynamic analysis is usually the most reliable way to classify a sample, but the emulator doesn't have all day to analyse, it has milliseconds so this is where most of the evasions come from. In addition, it requires constant profile updates. This is a rather weird design decision.