App Review More Fun with Ransomware Part 2

[cruelsister]

 

[Deleted member 2913]

Do these malware affects programs like Rollback, AX64, etc... I mean with these malware infection is it possible to restore system with the installed RB, AX64, etc...

Would be good to see a test on the above mentioned software.

And would be good to see a test on Voodoo Shield different Protection Modes.

 

[bob974]

@curelsister, I follow with interest your tests. Thank you

Do you think that appguard instead WinAntiRamson , is able to stop the ramsonware?

 

[hjlbx]

Deleted. Incorrect infos.

 

[cruelsister]

AppGuard is a finely coded security application, no doubt, and would stop stuff like this. The only issue I have with AppGuard (or any anti-exe) is that when AG is confronted by and unknown the user will get a popup where he/she must choose whether or not to run the file. An incorrect decision will end in tears.

 

[hjlbx]

AppGuard is a finely coded security application, no doubt, and would stop stuff like this. The only issue I have with AppGuard (or any anti-exe) is that when AG is confronted by and unknown the user will get a popup where he/she must choose whether or not to run the file. An incorrect decision will end in tears.

BRN changed it. It is just block notification. User now has to go through hidden UI to allow.

Still, handing AppGuard to novice with a not-so-great help file is... well, it just ain't gonna turn out so well for some. Virtualization is much easier for vast majority of users.

 

[_CyberGhosT_]

@CruelSis, new Teslacrypt 4 is reported to be unbreakable and a horror to stop. Cant wait for a test of that one. The way things are going I am going to have to keep my PC in a bubble lol. PeAcE

 

[bob974]

it would interesting to test it...

sorry see under this post

 

[bob974]

Lock-Down Mode - block execution of any ransomware

Protected (Medium) Mode - block execution of all unsigned ransomware; digitally signed ransomware will execute and encrypt C:\ProgramData and C:\Users\User directories. Ransom file can perform other actions in those directories dependent upon what is was coded to do.

I am still searching for digitally signed ransomware to verify.

it would be interesting to test it ...

 

[hjlbx]

it would be interesting to test it ...

Most advanced users just run AppGuard in Lock-Down mode. A few use Protected Mode. It doesn't really matter too much which policy is enforced if user never introduces new files to their system and attempts to execute them.

Infection much more likely the result of user mistake or carelessness when using AppGuard. Once you learn how to use it, much less likely to screw up.

Any how, this is kinda off-topic and I will leave it at that.

 

[Der.Reisende]

@cruelsister: Great vid as always, thank you for the Part II Seems as if Ransomware is becoming the biggest threat today. However, it has one good aspect: More and more people will be forced to do backups - even if they were too lazy in the past
Thank you for sharing

 

[TheMalwareMaster]

I can't see this video.. Why? Now I can view it, but the 1st time I tried from youtube it gave me an error

 

[Der.Reisende]

I can't see this video.. Why? Now I can view it, but the 1st time I tried from youtube it gave me an error

It asked me to view it on Youtube only due to the Music content used in the background (Copyright owner disallows showing it from embedded sources (like MT)).

EDIT: @TheMalwareMaster: Maybe due to my German IP.

 

[TheMalwareMaster]

It asked me to view it on Youtube only due to the Music content used in the background (Copyright owner disallows showing it from embedded sources (like MT)).

Thank you, I could only view it at MT instead.. And What about Bitdefender anti-ransomware module included in Bitdefender 2016?

 

[cruelsister]

Cyber- I actually was just sent a Tesla4 file this morning by a former colleague. It is curious that the files (Doc, Photos, etc) retain their original file extension while still being encrypted. So far I just infected a few machines for giggles and really don't see it as any great advance. Although I'm sure the usual suspects will call this THE WORST THING EVER personally I'll take a Tesla any day over a Winlocky..

 

[enaph]

Lock-Down Mode - block execution of any ransomware

Protected (Medium) Mode - block execution of all unsigned ransomware; digitally signed ransomware will execute and encrypt C:\ProgramData and C:\Users\User directories. Ransom file can perform other actions in those directories dependent upon what is was coded to do.

I am still searching for digitally signed ransomware to verify.

But is there any digitally signed ransomware in the wild?

 

[Atlas147]

Interesting to see that while ESET blocks the treat it somehow was still able to bypass it and get on the system? Does anyone have an explanation for that?

 

[enaph]

Interesting to see that while ESET blocks the treat it somehow was still able to bypass it and get on the system? Does anyone have an explanation for that?

I guess that ESET didn't detected all of it's components so something got into the system.

 

[cruelsister]

The ESET detections (aside from the desktop Tesla) were the real-time scanner picking up control samples in a directory that I placed on the C drive. As there are so many fans of ESET on other forums, I thought it would be a good idea to show that ESET was running and detecting. ESET didn't detect any part of Winlocky.

 

[enaph]

The ESET detections (aside from the desktop Tesla) were the real-time scanner picking up control samples in a directory that I placed on the C drive. As there are so many fans of ESET on other forums, I thought it would be a good idea to show that ESET was running and detecting. ESET didn't detect any part of Winlocky.

Now I have watched the video in full screen so I could read the ESET popups and now I see that none of the detections are related to Winlocky
Most of the people leave security suites at their default settings which is a huge fault since ESET can be easily customized for better detections through their non-signature based features.