Self-Made Fortran Malware Analysis

Status
Not open for further replies.
MS Defender configured

Capture d’écran 2024-12-25 173001.pngCapture d’écran 2024-12-25 173025.png

But once I reset it to default in DefenderUI, it passes without reaction (which was to be expected).

Capture d’écran 2024-12-25 173124.png
 
  • Like
  • +Reputation
  • Hundred Points
Reactions: Dreams&Visions, oldschool, simmerskool and 4 others
I see You got no bootable systems, but in the case of Kaspersky, system was not destroyed up to that point, in fact I could reboot without issues, but all my custom settings in my local account were changed to default or removed, for example the taskbar icons pinned, the order of the icons in the desktop, the color theme of the session, things like that, but system was completely usable.
 
Last edited:
  • Like
  • +Reputation
  • Applause
Reactions: Dreams&Visions, roger_m, Captain Awesome and 10 others
TuxTalk said:
Zone alarm?
Click to expand...
The emulation from the extension failed but pretty sure if you actually executed the sample the behavior components would have stopped it and probably the same with ksn , liveguard both failed but if you actually executed the sample it just might have stopped the infection using some behavior components
 
  • Like
Reactions: simmerskool and Captain Awesome
harlan4096 said:
I see You got no bootable systems, but in the case of Kaspersky, system was not destroyed up to that point, in fact I could reboot without issues, but all my custom settings in my local account were changed to default or removed, for example the taskbar icons pinned, the order of the icons in the desktop, the color theme of the session, things like that, but system was completely usable.
Click to expand...
Above harlan showed that actually execution ofthe sample would cause behavior components to defend at least some damage and the same will happen with some other avs

(Edit Harlan below showed that it was actually the hips component that blocked some of the malicious activity)
 
Last edited:
  • Like
Reactions: simmerskool and harlan4096
Hum actually the sample did not trigger any behavior component (although KOTIP service tagged it as malware in 1st execution), but probably Intrusion Prevention, putting it in Low Restricted group, minimized in part, the malicious activities, and avoided to completely destroy the system.
 
  • Like
  • +Reputation
Reactions: simmerskool, roger_m, Berny and 3 others
harlan4096 said:
Hum actually the sample did not trigger any behavior component (although KOTIP service tagged it as malware in 1st execution), but probably Intrusion Prevention, putting it in Low Restricted group, minimized in part, the malicious activities, and avoided to completely destroy the system.
Click to expand...
I don't think it was in the first execution in the opentip sandbox but changing the hash is probably enough to find out
 
  • Like
Reactions: simmerskool
Status
Not open for further replies.

You may also like...