Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 799354" data-attributes="member: 32260">That is a known fact for many years. The attacker has to compile/obfuscate something that can be detected as suspicious, but not suspicious enough to trigger the detection as malware.Most of bypassed AVs, detected it probably as suspicious but allowed it to run without or with only a few restrictions.As [USER=36043]@harlan4096[/USER] noticed, some of Kaspersky (also WD and possibly other AVs) advanced modules were not configured (Application Control, ASR, etc), so the tests were not performed on max settings. Furthermore, the malware was allowed to run with Administrator rights, and was not downloaded from the Internet as an EXE file (probably in the compressed archive - no SmartScreen alert).It is not so easy to create the malware that could bypass Kaspersky&#039;s enhanced (but not max) settings, anyway.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Yet, it is not so difficult too, for a knowledgeable coder.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" /></blockquote>

[QUOTE="Andy Ful, post: 799354, member: 32260"] That is a known fact for many years. The attacker has to compile/obfuscate something that can be detected as suspicious, but not suspicious enough to trigger the detection as malware. Most of bypassed AVs, detected it probably as suspicious but allowed it to run without or with only a few restrictions. As [USER=36043]@harlan4096[/USER] noticed, some of Kaspersky (also WD and possibly other AVs) advanced modules were not configured (Application Control, ASR, etc), so the tests were not performed on max settings. Furthermore, the malware was allowed to run with Administrator rights, and was not downloaded from the Internet as an EXE file (probably in the compressed archive - no SmartScreen alert). It is not so easy to create the malware that could bypass Kaspersky's enhanced (but not max) settings, anyway.(y) Yet, it is not so difficult too, for a knowledgeable coder.:( [/QUOTE]

Verification