Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 881353" data-attributes="member: 83059">I am in agreement. I do not believe signature detection is the right thing to do, and I&#039;m kind of surprised that this one wasn&#039;t marked as a &quot;hoax&quot; like my last few.BTW, the signature for this file is very specific. This change alone (from single quotes to 3 quotes) results in no detection:[code]-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; encrypt(dir+filename, dir+filename+&quot;&quot;&quot;.enc&quot;&quot;&quot;)+&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; encrypt(dir+filename, dir+filename+&quot;.enc&quot;)[/code]In my opinion it&#039;s almost a waste of time for ESET to be adding signatures for this script. Signature detections are not the right approach here. Maybe a Python sandbox or better, runtime behavior detection.EDIT: What I would really like is an explanation for why their Ransomware Shield isn&#039;t working against this sample. ESET says <a href="https://help.eset.com/glossary/en-US/technology_ransomware_protection.html" target="_blank">Ransomware Shield | ESET Glossary | ESET Online Help</a>This sounds like a behavior blocker and similar to how WiseVector stops ALL variants of this attack, and how KSW and some other behavior blockers can stop the start.bat variant.</blockquote>

[QUOTE="MacDefender, post: 881353, member: 83059"] I am in agreement. I do not believe signature detection is the right thing to do, and I'm kind of surprised that this one wasn't marked as a "hoax" like my last few. BTW, the signature for this file is very specific. This change alone (from single quotes to 3 quotes) results in no detection: [code] - encrypt(dir+filename, dir+filename+""".enc""") + encrypt(dir+filename, dir+filename+".enc") [/code] In my opinion it's almost a waste of time for ESET to be adding signatures for this script. Signature detections are not the right approach here. Maybe a Python sandbox or better, runtime behavior detection. EDIT: What I would really like is an explanation for why their Ransomware Shield isn't working against this sample. ESET says [URL="https://help.eset.com/glossary/en-US/technology_ransomware_protection.html"]Ransomware Shield | ESET Glossary | ESET Online Help[/URL] This sounds like a behavior blocker and similar to how WiseVector stops ALL variants of this attack, and how KSW and some other behavior blockers can stop the start.bat variant. [/QUOTE]

Verification