App Review Microsoft Defender vs Magniber

[Andy Ful]

Any security application should aspire to protect ALL types of users (no matter the intellect)...

I think that @wat0114 used the term "brain" not for the intellect but probably for knowledge + safe habits. Several MT members often use it in this meaning.
Probably most MT members used the pirated content from time to time.

 

[Andy Ful]

My strictly personal opinion about the best anti-ransomware protection "for all users" is for the advantage of Comodo Antivirus with a low or medium level of auto-containment (tested by @cruelsister).
The ransomware is not blocked in the sandbox, so the user can see the destructive actions and the final ransomware request. Furthermore, the ransomware cannot upload files (due to the firewall restrictions) in the double extorsion attacks. Such protection is not so strong as Comodo Firewall with CS settings, but in many cases, it will prevent the users from disabling the protection in the socio-technical attacks. Unfortunately, the protection based on auto-containment has got a few cons that make it unpopular.

The Comodo Firewall with CS settings (and similar solutions) can be probably better in the "home administrator" scenario, where the family members use Comodo Firewall, but only the advanced user can change the settings when this is necessary.

Another good solution for all users can be Kaspersky, but if I correctly recall, in the default settings it cannot fully prevent stealing the files in the double extorsion attacks. But, I can be wrong.

The anti-ransomware protection of Defender free can be very efficient in widespread attacks, but it is not so comprehensive as that of Comodo or Kaspersky. It is based on the assumption that by making the ransomware "very-short-living", the number of victims can be significantly reduced. The protection can be better when using ConfigureDefender HIGH settings, but still not as good as Comodo with auto-containment. With MAX settings almost all ransomware will be blocked, but like in the case of Comodo Firewall with CS settings, such a solution is better suited to the "home administrator" scenario (and still slightly worse than CF with CS settings).

 

[Anthony Qian]

IYes, that can happen with fully working BAFS. The ransomware attack usually uses many different initial samples, so even if one sample would infect only one user, there still can be several infected users with fully working BAFS. Anyway, the BAFS is still efficient if it can prevent one sample from infecting many users.
In some scenarios, BAFS + postinfection detection will not be efficient for example, when a hacker prepares one sample for one target - there is no gain from BAFS because, after the infection, one infected target is equal to 100% infected victims.

By the way how many infected users were confirmed?

I assume that Microsoft's automatic analysis system cannot detect Magniber because I submitted several samples to Microsoft Security Intelligence, and after several minutes the samples were still undetected (samples submitted to this platform are analyzed automatically and then manually if the automation cannot make a decision.)

As for the prevalence of Magniber in China, please take a look at the below picture (published by Qihoo, one of the largest security vendors in China):

 

[Andy Ful]

I assume that Microsoft's automatic analysis system cannot detect Magniber because I submitted several samples to Microsoft Security Intelligence, and after several minutes the samples were still undetected (samples submitted to this platform are analyzed automatically and then manually if the automation cannot make a decision.)

Unfortunately, your procedure is not valid for testing BAFS:

1. If the MSI file is submitted, we do not know if it is going to be tested immediately in the sandbox. So, you cannot expect that the BAFS detection will work after several minutes.
2. The file is scanned once just after the download. So, you have to download it again after several minutes to trigger BAFS.

The proper way (in a Virtual Machine) is to run the malware, and wait until it will infect the machine. Next, use another snapshot, and download the malware after several minutes. The sample must be downloaded directly as the MSI file (cannot be embedded in the ISO, 7-ZIP, etc.).

As for the prevalence of Magniber in China, please take a look at the below picture (published by Qihoo, one of the largest security vendors in China):

View attachment 268005

This chart shows the spread of Magniber and not the confirmed infections. Furthermore, the chart can be related to 360 antivirus detections.

Win11 users beware! Magniber ransomware has been upgraded again, aiming at win11 | 360 Total Security Blog

At the end of April this year, the Magniber ransomware disguised as a Windows 10 upgrade patch package and spread widely, and 360 Security Center...

blog.360totalsecurity.com

By any means, it does not show confirmed infections of Microsoft Defender users.

 

[Stelica]

Hi,
I have Windows 10 Pro 21H2, Windows Defender default settings, but I use Sandboxie inside Shadow Defender. Can it be a good solution?

 

[Shadowra]

Hi,
I have Windows 10 Pro 21H2, Windows Defender default settings, but I use Sandboxie inside Shadow Defender. Can it be a good solution?

It all depends on your use
If it's basic surfing, yes it's more than enough (you can also virtualize your browser in Sandboxie).

On the other hand, if you go on risky sites, I would advise you to modify Windows Defender with DefenderUI or ConfigureDefender

 

[Stelica]

It all depends on your use
If it's basic surfing, yes it's more than enough (you can also virtualize your browser in Sandboxie).

On the other hand, if you go on risky sites, I would advise you to modify Windows Defender with DefenderUI or ConfigureDefender

I use always Sandboxie for both browsers (firefox and edge) inside Shadow Defender and I don't go to dubious sites!

 

[Shadowra]

I use always Sandboxie for both browsers (firefox and edge) inside Shadow Defender and I don't go to dubious sites!

So don't touch anything, it's enough

 

[Andy Ful]

Unfortunately, your procedure is not valid for testing BAFS:

1. If the MSI file is submitted, we do not know if it is going to be tested immediately in the sandbox. So, you cannot expect that the BAFS detection will work after several minutes.
2. The file is scanned once just after the download. So, you have to download it again after several minutes to trigger BAFS.

The proper way (in a Virtual Machine) is to run the malware, and wait until it will infect the machine. Next, use another snapshot, and download the malware after several minutes. The sample must be downloaded directly as the MSI file (cannot be embedded in the ISO, 7-ZIP, etc.).

@Anthony Qian,

I made some testing that included points 1 and 2 from my previous post. Your suspicion about BAFS was correct. The MSI samples of Magniber (and probably any MSI malware) are not detected by BAFS.

 

[cruelsister]

Just wanted to clear up any misconceptions.

 

[ForgottenSeer 69673]

Where A and B the same file? If so, does it matter if you click start actions before running it a second time?

 

[SeriousHoax]

Just wanted to clear up any misconceptions.

This is a good demonstration. I've known this for a long time. It's the same when you submit samples to Microsoft. Their submission portal might show the cloud detection name but it doesn't guarantee that the file is detected. Usually, the Final Determination part is the important one.
It's probably something like that MD's VT engine is set to a lower threshold so it's more aggressive than regular. But yes this gives the user the wrong idea. I never trust MD's results on VT unless I check it myself on my device.

 

[Andy Ful]

Just wanted to clear up any misconceptions.

The second sample is also detected by Defender when doing it in the way I described here:
https://malwaretips.com/threads/a-microsoft-defender-follow-up.115026/post-998527

Simply after downloading/unpacking the sample, one has to manually perform Defender's scan on this sample and follow the Defender alert to clean the threat.
You can use another sample that is undetected even with this manual scan:
33211a8202f4ad33f01cd90c6b1f51068a84ace5dd85a891efe5e6c210b0e7ef.msi

 

[ForgottenSeer 69673]

The second sample is also detected by Defender when doing it in the way I described here:
https://malwaretips.com/threads/a-microsoft-defender-follow-up.115026/post-998527

Simply after downloading/unpacking the sample, one has to manually perform Defender's scan on this sample and follow the Defender alert to clean the threat.
You can use another sample that is undetected even with this manual scan:
33211a8202f4ad33f01cd90c6b1f51068a84ace5dd85a891efe5e6c210b0e7ef.msi

Like I said, you have to click start actions before running the same file again

 

[Andy Ful]

Like I said, you have to click start actions before running the same file again

The video uses two different samples. The second sample is not automatically detected until you manually scan it.

 

[cruelsister]

Where A and B the same file?

The only difference is the web address where to send the ransom payment, otherwise identical- the mechanism is the same which is why this should be particularly troubling. This is similar to what is being done currently with some info stealers (where the data is sent).

 

[WhiteMouse]

The video uses two different samples. The second sample is not automatically detected until you manually scan it.

I think that will defeat the point of having "Real-time protection".

 

[ForgottenSeer 69673]

The only difference is the web address where to send the ransom payment, otherwise identical- the mechanism is the same which is why this should be particularly troubling. This is similar to what is being done currently with some info stealers (where the data is sent).

Thank you Cruel for the explanation

 

[ForgottenSeer 69673]

Hi,
I have Windows 10 Pro 21H2, Windows Defender default settings, but I use Sandboxie inside Shadow Defender. Can it be a good solution?

This is a great idea. I use Sanboxie Plus's Browser inside Shadow Defender, with SD set to use cache (1 Gig ) . Only wish more people would do this.

 

[Chuck57]

Not a malware tester, but I think Comodo will contain and isolate both.