Ransomware Campaign Alters Variants to Evade Detection

[LabZero]

Content source

https://threatpost.com/ransomware-campaign-alters-variants-to-evade-detection/113690

A recently uncovered operation has been mutating versions of ransomware to better avoid getting detected.

As part of the campaign, which researchers from Cambridge-based Cybereason have dubbed Kofer, attackers are tweaking certain variables of ransomware like CryptoWall 3.0 and Crypt0L0cker to evade static signature or hash-based detection.

While the malware variants are different, researchers have deduced that they’re being altered by one, singular group.

More

 

[Solarquest]

What are AV doing and what can they do to detect (proactively) these variants?
Are they using generic signatures? My inpression is most AV detect each sample by signature/hash after they got a sample or hope the BB detect it...only few have generic or good generic signatures/heuristic.....I might (hope to)be wrong...