App Review Kaspersky AntiRansomware for Business beta- Part 1

[cruelsister]

 

[Terry Ganzi]

Thank you. I was waiting on this test from you impatiently.

 

[XhenEd]

Good video again, cruelsister!

As far as I know, "PDM" is the behavioral detection of Kaspersky, and "UDS" is the cloud detection. From what is seen on the video, all detections are PDM detections.

 

[WinXPert]

I pitted Kaspersky AntiRansomware with Ransomware #3.zip (MalwareTips, Sept 10) and it did a great job of allowing the sample to encript my files

 

[Tony Cole]

Wow, failed on the true zero-day malware. That's why I run (in edition to an antivirus) AppGuard so it will block everything, especially in lock down mode.

Welcome back cruelsister! Love your video's, shows us what the AV companies do not!

 

[jamescv7]

In my presumption, Kaspersky should do well cause they have good behavior detection and cloud analysis.

But seems these techniqies should incorporate more deep and not rely on what's available on AV.

 

[harlan4096]

I pitted Kaspersky AntiRansomware with Ransomware #3.zip (MalwareTips, Sept 10) and it did a great job of allowing the sample to encript my files

Are You referring to this samples pack: https://malwaretips.com/threads/10-09-2016-3.63266/#post-541864 ?

 

[Windows_Security]

@FORUM_MODS and @FORUM_MEMBERS

I hope you don't take this as an insult, I do value your contributions, but ......

@cruelsister video's have the same appeal to me as new episodes of house of cards or ghomorrah to name a few of my favourite block buster TV series

Regards Kees

 

[SHvFl]

Nice test once more. Good job and can't wait for the second part which will be the important part for me.

 

[_CyberGhosT_]

It's a "beta" taking that into consideration it did pretty well
in the first test. Thanks CruelSis

 

[Evjl's Rain]

it does better than some other antiransomware tools and some cloud AVs + it's free
It's like a trimmed down version of Kaspersky free (KFA) for RU

 

[Der.Reisende]

Great vid, as always, thank you for sharing
About Kitty, the wallpaper looks like some ransomware I've seen before (please don't ask me which, so many variants in the wild). Is it done by you or a reprogrammed version of...?
Looking forward eagerly to Pt. 2!

 

[cruelsister]

Kitty is a Locky variant that I morphed. This is what the serious Gangs will do to keep the ransomware fresh- every 8-12 hours one will be retired and a morphed one distributed. The reasoning here is that any malware newly released should be assumed to have a detection free period of 8-12 hours (if widely distributed and not targeted); so the longer a given sample remains in the wild, the more AV's will pick it up leading to diminishing returns.

 

[hjlbx]

Kitty is a Locky variant that I morphed. This is what the serious Gangs will do to keep the ransomware fresh- every 8-12 hours one will be retired and a morphed one distributed. The reasoning here is that any malware newly released should be assumed to have a detection free period of 8-12 hours (if widely distributed and not targeted); so the longer a given sample remains in the wild, the more AV's will pick it up leading to diminishing returns.

I have seen exploited sites where the malc0der monitored site activity in real-time and changed the distributed malicious file every hour or so. It became easy to track the malc0der's habits; he\she followed a schedule. The attack was active at 11 am every day until 2 pm - with two or three new variants pushed within that time period.

And no, in these particular cases, the attack was not fully automated; the malc0der was actually on-line during every single attack.

 

[Behold Eck]

Another good job C.S.

Nasty, nasty Kitty can`t wait to see pt2 of this cliffhanger.

Regards Eck

 

[Der.Reisende]

Kitty is a Locky variant that I morphed. This is what the serious Gangs will do to keep the ransomware fresh- every 8-12 hours one will be retired and a morphed one distributed. The reasoning here is that any malware newly released should be assumed to have a detection free period of 8-12 hours (if widely distributed and not targeted); so the longer a given sample remains in the wild, the more AV's will pick it up leading to diminishing returns.

Thank you for the fast & comprehensive reply

I have seen exploited sites where the malc0der monitored site activity in real-time and changed the distributed malicious file every hour or so. It became easy to track the malc0der's habits; he\she followed a schedule. The attack was active at 11 am every day until 2 pm - with two or three new variants pushed within that time period.

And no, in these particular cases, the attack was not fully automated; the malc0der was actually on-line during every single attack.

I wonder if those guys can make their living out of that, as something like that must cost lots of time.
Great addition to this topic, thank you!

 

[hjlbx]

I wonder if those guys can make their living out of that, as something like that must cost lots of time.

Not only can they make a living, it can make them rich...

 

[adyblueboy]

Nice... maybe Malwarebytes Anti-Ransomware is better?

 

[hjlbx]

Nice... maybe Malwarebytes Anti-Ransomware is better?

No. MBAR doesn't have the best track record.

Besides, one can eventually find a ransomware that will defeat\bypass all anti-ransomware products.

 

[N31R]

Good video again, cruelsister!

As far as I know, "PDM" is the behavioral detection of Kaspersky, and "UDS" is the cloud detection. From what is seen on the video, all detections are PDM detections.

"PDM.Trojan.Win32.Bazon.a" is a cloud behavioral detection. You'll see that the detection name won't appear in an offline test- only PDM.Trojan.Win32.Generic and similar Generic detection names (local behavioral detection rules).