Self-Made Fortran Malware Analysis

[anirbandutta01]

Is Kaspersky able to detect?

 

[Vitali Ortzi]

Bitdefender failed

View attachment 286850View attachment 286851View attachment 286852

@anirbandutta01

Still amazed virus scope catched it
Got it enabled only in the container on my system but maybe if it gets better I could enable it globally

 

[Vitali Ortzi]

Is Kaspersky able to detect?

Not at first site but by manually
And maybe the behavior components , hips can prevent the infection itself

 

[anirbandutta01]

K

Bitdefender failed

View attachment 286850View attachment 286851View attachment 286852

@anirbandutta01

Kaspersky?

 

[Nikola Milanovic]

Still amazed virus scope catched it
Got it enabled only in the container on my system but maybe if it gets better I could enable it globally

VirusScope is amazing at analyzing unknown apps in sandbox it uses Static Analysis and Dynamic Analysis to do that

 

[Shadowra]

MS Defender configured



But once I reset it to default in DefenderUI, it passes without reaction (which was to be expected).

 

[anirbandutta01]

MS Defender configured

View attachment 286859View attachment 286860

But once I reset it to default in DefenderUI, it passes without reaction (which was to be expected).

View attachment 286861

Please check Kaspersky

 

[Shadowra]

Please check Kaspersky

@harlan4096 has already done so and mentioned

 

[anirbandutta01]

@harlan4096 has already done so and mentioned

Sorry I missed. @harlan4096 could you please reply again??

 

[HydraDragonAntivirus]

Interesting, hadn't heard previously that Rising uses the cloud from Kaspersky.
View attachment 286845

VirusTotal What about Zillya?

 

[harlan4096]

I see You got no bootable systems, but in the case of Kaspersky, system was not destroyed up to that point, in fact I could reboot without issues, but all my custom settings in my local account were changed to default or removed, for example the taskbar icons pinned, the order of the icons in the desktop, the color theme of the session, things like that, but system was completely usable.

 

[cartaphilus]

Lest Eset's dynamic analysis isn't sad alone, Sophos also totally lost this battle. While its screens show significant damage to the system.
View attachment 286842

View attachment 286843

Shaka when walls fell

Temba his arms wide

 

[TuxTalk]

Zone alarm?

 

[Vitali Ortzi]

Zone alarm?

The emulation from the extension failed but pretty sure if you actually executed the sample the behavior components would have stopped it and probably the same with ksn , liveguard both failed but if you actually executed the sample it just might have stopped the infection using some behavior components

 

[Vitali Ortzi]

I see You got no bootable systems, but in the case of Kaspersky, system was not destroyed up to that point, in fact I could reboot without issues, but all my custom settings in my local account were changed to default or removed, for example the taskbar icons pinned, the order of the icons in the desktop, the color theme of the session, things like that, but system was completely usable.

Above harlan showed that actually execution ofthe sample would cause behavior components to defend at least some damage and the same will happen with some other avs

(Edit Harlan below showed that it was actually the hips component that blocked some of the malicious activity)

 

[harlan4096]

Hum actually the sample did not trigger any behavior component (although KOTIP service tagged it as malware in 1st execution), but probably Intrusion Prevention, putting it in Low Restricted group, minimized in part, the malicious activities, and avoided to completely destroy the system.

 

[Vitali Ortzi]

Hum actually the sample did not trigger any behavior component (although KOTIP service tagged it as malware in 1st execution), but probably Intrusion Prevention, putting it in Low Restricted group, minimized in part, the malicious activities, and avoided to completely destroy the system.

I don't think it was in the first execution in the opentip sandbox but changing the hash is probably enough to find out

 

[Vitali Ortzi]

Lest Eset's dynamic analysis isn't sad alone, Sophos also totally lost this battle. While its screens show significant damage to the system.
View attachment 286842

View attachment 286843

It's easy to evade sophos anyway as they literally load services of sophos software into the sandbox of intelix

 

[ForgottenSeer 114717]

Fortran

Same with Basic, Cobol, and Pascal

 

[Vitali Ortzi]

Same with Basic, Cobol, and Pascal

View attachment 286865

Not just that new gaming engine languages and even rust to some extent