App Review K7 Total Security vs CXK-NMSL ransomware

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.

Der.Reisende

Level 45
Honorary Member
Top Poster
Content Creator
Malware Hunter
Dec 27, 2014
3,423
Not surprising, K7‘s biggest weakness is Ransomware.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.
 

stefanos

Level 28
Thread author
Verified
Top Poster
Well-known
Oct 31, 2014
1,712
Not surprising, K7‘s biggest weakness is Ransomware.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.
The same 360 TS.
 

Parsh

Level 25
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
Dec 27, 2016
1,480
If I'm not wrong, this hub sample was a similar variant @Der.Reisende tested - that was modified by CS.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.
 

Der.Reisende

Level 45
Honorary Member
Top Poster
Content Creator
Malware Hunter
Dec 27, 2014
3,423
If I'm not wrong, this hub sample was a similar variant @Der.Reisende tested - that was modified by CS.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.
It's K7 DataLocker protecting folders (by default Documents and Pictures; with multiple users, it autodetects the folders). It's not a part of the Behaviour Blocking mechanism. It's rather the last line of defense, which can also fail.
I removed dllhost.exe from, and added SoftMaker Office to the trusted list.
1586976720093.png

EDIT: K7 DataLocker will block write access for everything not in the list, and to protected folders.
It even blocks Snipping Tool from saving pictures to the same name folder, with same error message, if not whitelisted.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top