App Review My own "ransomware" vs Windows Defender

[bayasdev]

Content source

https://www.youtube.com/watch?v=jbu2GXYlCzE&feature=youtu.be

It uses a LOLbin (7Zip in this case) to "encrypt" the files and was coded by myself in C. I'm pretty sure this can bypass most AVs due to their whitelisting approach with common apps like 7z.exe.

 

[Vitali Ortzi]

pm me the sample

 

[struppigel]

There has been ransomware using zip archives and LOLbins before. E.g. Bart ransomware (creates zip archives), CrypVault (uses GnuPG.exe). Those are not more or less difficult in regards of detection. It being newly written from scratch plays probably the biggest role in bypassing AV. There is still code that calls the LOLbins. There is still behaviour that can be detected as suspicious. Using clean software doesn't suddenly taint everything else as clean too.

 

[bayasdev]

There has been ransomware using zip archives and LOLbins before. E.g. Bart ransomware (creates zip archives), CrypVault (uses GnuPG.exe). Those are not more or less difficult in regards of detection. There is still code that calls the LOLbins. There is still behaviour that can be detected as suspicious. Using clean software doesn't suddenly taint everything else as clean too. It being newly written from scratch plays probably the biggest role in bypassing AV, not the means how it encrypts.

The first victim will probably get infected but the AV's cloud system will probably flag a suspicious activity from the parent process and get it blocked by signatures, a software solution that prevents changes to userspace folders will block it at the cost of the user getting lots of popups every time he edits or creates a file legitimately.

 

[struppigel]

AV's cloud system will probably flag a suspicious activity from the parent process and get it blocked by signatures

That's not how it works

 

[Vitali Ortzi]

There has been ransomware using zip archives and LOLbins before. E.g. Bart ransomware (creates zip archives), CrypVault (uses GnuPG.exe). Those are not more or less difficult in regards of detection. It being newly written from scratch plays probably the biggest role in bypassing AV. There is still code that calls the LOLbins. There is still behaviour that can be detected as suspicious. Using clean software doesn't suddenly taint everything else as clean too.

Malware has been using lolbins since forever !
But every sample is welcome

 

[bayasdev]

That's not how it works

I know an AV has kernel hooks/drivers to monitor everything that's going on the system and some even use W10 AMSI for script/powershell malware but most of them by default are lowered down to lower the FP rate (ESET IS) and others lack a proper implementation AKA behavior blocker technology. I remember Emsisoft behavior blocked getting bypassed calling a legitimate file present in the system and then it got updated.

 

[struppigel]

I know an AV has kernel hooks/drivers to monitor everything that's going on the system and some even use W10 AMSI for script/powershell malware but most of them by default are lowered down to lower the FP rate (ESET IS) and others lack a proper implementation AKA behavior blocker technology. I remember Emsisoft behavior blocked getting bypassed calling a legitimate file present in the system and then it got updated.

I believe we use terminology differently and that's the actual misunderstanding here (regarding cloud and signatures). Yes, I agree, certain heuristics can be more prone to false positives and may need a higher threshold to flag this as malware. The ability to monitor behaviour is also probably very different for every AV product, so some will see more events than others. That may give this ransomware a head start with certain products in regards to behaviour monitoring.

 

[MacDefender]

MacDefender Test #2, "Trojan" Ransomware

As we talked about over in the Emsi vs F-Secure thread (Help Me Decide - Emsisoft vs. Eset Internet Security vs. BitDefender Total Security vs. F-Secure Safe (2020) ), one weakness I've found in F-Secure and other Behavior Blockers is that the most common way to escape the behavior blocker is by...

malwaretips.com

I did something very similar. Other than Kaspersky (partial protection), almost every other AV had difficulties with this sample. Zero day ransomware's best chance at success is by leveraging a whitelisted runtime or encrypting tool.

It is a technique we've seen in the wild throughout history, but worth remembering that even state of the art behavior blockers struggle with it.

 

[struppigel]

Heuristics have the issue that ransomware behaviour is not distinguishable from e.g. backup software that saves space by compressing files. Compression looks just like encryption, it raises the entropy. Renaming lots of files at once is not malicious, nor is encryption or compression. These actions only become malicious in context. So most of the time there needs to be something additional like anti-AV features, UAC bypass features, shadow copy deletion, certain ransom note keywords, code injection.

If you create a bare ransomware from scratch just using the encryption portion and no additional features, there is no way to detect it with heuristics without also flagging legitimate software.

 

[MacDefender]

Heuristics have the issue that ransomware behaviour is not distinguishable from e.g. backup software that saves space by compressing files. Compression looks just like encryption, it raises the entropy. Renaming lots of files at once is not malicious, nor is encryption or compression. These actions only become malicious in context. So most of the time there needs to be something additional like anti-AV features, UAC bypass features, shadow copy deletion, certain ransom note keywords, code injection.

If you create a bare ransomware from scratch just using the encryption portion and no additional features, there is no way to detect it with heuristics without also flagging legitimate software.

Yeah really the main thing you can go by is the idea of a low reputation binary modifying files, especially in My Documents and other user-valuable paths. This is how most behavior blocker identify ransomware and when a low-reputation EXE is doing that work themselves, that is an easy rule to write. Kaspersky and Emsisoft simply halt such an application mid-act and give you a few seconds to answer whether or not you expected them to be doing this. Others automatically terminate the application but give you an option to whitelist and try it again.

This proactive technique breaks down for scripts (difficult to measure reputation) and when you use another binary that's well-trusted to do your dirty work for you.

For the latter, I think the right answer is enhancing behavior blockers to account for "who started this application?" and if it's an untrusted process, consider the child process untrustworthy too.

 

[bayasdev]

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

KSC Free tested

 

[DSD27]

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

KSC Free tested

Will you test Avast free?

 

[bayasdev]

Will you test Avast free?

yes, wait me to restore the VM snapshot

 

[bayasdev]

Will you test Avast free?

Any particular setting or default?

 

[DSD27]

Any particular setting or default?

It has a behavior shield, it sandboxes unknown files... I guess that should be on, which probably is by default, idk. I'm not using Avast right now, just curious.
But you could try both default and Hardened Mode.

 

[bayasdev]

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

Avast Free

 

[DSD27]

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

Avast Free

Well well Avast... Well done.

"-How do you hate me now?"

 

[silversurfer]

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

Avast Free

What about Bitdefender Free?

 

[stefanos]

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

Avast Free

Throw one nice kill to Bitdefender free , then we will have a party of comments