- Oct 31, 2014
- 1,712
- Content source
- https://www.youtube.com/watch?v=j-0P7yBZy14
Kaspersky Endpoint Security 11 vs CXK-NMSL ransomware
- Thread starter stefanos
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
- Dec 23, 2014
- 8,511
It seems that this malware is generally similar to the CXK-NMSL ver. 3.3:
app.any.run
The attack uses the batch file and some LOLBins (certutil.exe, choice.exe, wscript.exe, rundll32.exe) to avoid detection.
Analysis 2020.1.10-2020.1.23Information on Travelers from Wuhan China to India.zip (MD5: F94D84DA27BD095FDEAF08ED4F7D8C9A) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
- Apr 28, 2015
- 8,910
As I always say in these cases, probably a tweaked Application Control would not compromise the system... all those tools used to encrypt the system are legit (system LOLBins) hehe...
www.f5.com
Old Dog, New Targets: Switching to Windows to Mine Electroneum
Apache Struts 2 Jakarta Multipart Parser RCE crypto-mining campaign is now targeting Windows, not just Linux systems.
www.f5.com
Last edited:
- Dec 23, 2014
- 8,511
It would be interesting to test this on MH. If one does not use Trusted Application Mode (can detect batch files), then many setups based on Application Control tweaks can be insufficient. Probably, one has to add cmd.exe and certutil.exe to the untrusted group. Adding cmd to the untrusted group can produce software incompatibilities.
But, I may be wrong (I do not use KIS for some years).
Last edited:
- Apr 1, 2019
- 2,868
Protected folders/Controlled folder access should work in these cases? I guess unless one of these legit processes has already been granted access... Obviously Kaspersky has their own methods, application control.
Last edited:
- Apr 28, 2015
- 8,910
Protected folders can be also implemented in Kaspersky products (Application Control -> Manager Resources), although it is not so easy than WD or others products just enabling and adding apps... but Kaspersky way is more customizable and You can assign rights for different opeations over the files, folders, registry keys...
@Andy Ful: that variant of your link is already detected by Kaspersky, but probably the video one is a variant still not detected or it was recorded when still not detected...
I think TAM is not necessary to also stop .bat files attacks -> System Watcher can do it also...
@Andy Ful: that variant of your link is already detected by Kaspersky, but probably the video one is a variant still not detected or it was recorded when still not detected...
I think TAM is not necessary to also stop .bat files attacks -> System Watcher can do it also...
- Dec 23, 2014
- 8,511
Yes, this is the new version 4.0 - did not found the analysis yet. But, the method is similar to ver. 3.3. Do you have any idea why the batch file from version 4.0 was not blocked by System Watcher?
- Apr 28, 2015
- 8,910
Probably they used certutil.exe to download an encrypted malware, as explained in my previous post link... don't know
Also those additional LOLBins used by the malware are trusted in Application Control and KSN by default, so...
I see Symantec EndPoint also failed
Also those additional LOLBins used by the malware are trusted in Application Control and KSN by default, so...
I see Symantec EndPoint also failed
- Apr 13, 2013
- 3,224
It is really nothing but a batch file (built around certutil with an encode verb) with a vbs tweak for show.
- Dec 23, 2014
- 8,511
The previous version used an oversized batch file (7.10 Mb) which probably contained the malware. So, the crucial thing would be to block this batch file. The certutil.exe was used to encrypt files (via "certutil -encode" command-line) with legal certificates (*.der files).
- Dec 23, 2014
- 8,511
My first thought was that the big batch file contained base64 encoded malware which was next decoded by using the command-line "certutil -decode" like in the below example:
BAT file based Ransomware targeting people in China – SonicWall
But, the ver. 3.3 did not use such a command-line, only "certutil -encode" was used. The video also suggests using only "certutil -encode" command-line.
BAT file based Ransomware targeting people in China – SonicWall
But, the ver. 3.3 did not use such a command-line, only "certutil -encode" was used. The video also suggests using only "certutil -encode" command-line.
Last edited:
- Dec 23, 2014
- 8,511
We've missed you here.
- Apr 13, 2013
- 3,224
Thanks Andy!!!
The initial file had a vbs script that added the media player file and the desktop icons, and this added to the file size.
The initial file had a vbs script that added the media player file and the desktop icons, and this added to the file size.
- Dec 23, 2014
- 8,511
- Jan 11, 2020
- 220
OT: for a moment when I saw the CS nickname I thought I had mistakenly opened an old post. Then I realized it was a new message. Wow welcome back CS.
- Apr 13, 2013
- 3,224
Thank you!!! It certainly is odd being a C19 stay-at-homehomer, but at least it gives an opportunity to see old friends!
ps- CF laughs at stuff like this malware.
ps- CF laughs at stuff like this malware.
Hah, I guess it's starting to gain a little popularity.... I picked 7z for my fake malware but that's my lack of creativity. Using certutil is kind of cute.
On Linux/macOS, it's really common these days that either python or the openssl command is used to achieve either de-obfuscation or outright cryptoransom.
This is going to be a new area of challenge for behavior blockers / dynamic protection to understand. Combined with the ability to obfuscate scripts themselves, IMO this has to be handled by dynamic protection, not just some sort of static scanner or even a fancy signature scanner.... Looking forward to see what vendors come up with!
- Mar 28, 2019
- 569
- Jun 24, 2016
- 2,485
Why is Application Control OFF? Most important module of Kaspersky...
- Mar 28, 2019
- 569
As far as I know, application control at the endpoint is not the same.
Endpoint HIPS = home users application control, names are different, can cause confusion.
Similar threads
