Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1000627" data-attributes="member: 32260">Today I analyzed the sample posted to me by [USER=78686]@SeriousHoax[/USER].The sample &quot;220816-z6jahaebgl_pw_infected.zip&quot; is a password-protected ZIP archive that contains the EXE payload.It is an interesting example for this thread:<ol>
<li data-xf-list-type="ol">The ZIP sample is detected by Microsoft Defender via BAFS (when downloaded from the URL or OneDrive). The detection is: Script/Ulthar.A!ml</li>
<li data-xf-list-type="ol">This ZIP sample is not detected by AVs on VirusTotal (including Microsoft Defender).</li>
<li data-xf-list-type="ol">The EXE file embedded in the ZIP sample is not detected by Microsoft Defender (I could also execute it on the computer with Microsoft Defender).</li>
</ol>[ATTACH=full]268772[/ATTACH][ATTACH=full]268773[/ATTACH]This example shows that Microsoft Defender can sometimes block the attack in the wild when the initial malware is an archive from the Internet, and fail in the test with an EXE payload used in this attack. Such EXE files can increase an &quot;EXE test error&quot; for Microsoft Defender. We cannot expect in all cases, that when Defender can block the attack in the wild, it can also block all EXE payloads that are going to be used in this attack.This example also shows that the Defender protection (default settings) is not comprehensive but rather very practical and focused on web threats. As we can see from VirusTotal, some popular AVs can detect the EXE payload that was missed by Defender, so they will not fail in the EXE test.</blockquote>

[QUOTE="Andy Ful, post: 1000627, member: 32260"] Today I analyzed the sample posted to me by [USER=78686]@SeriousHoax[/USER]. The sample "220816-z6jahaebgl_pw_infected.zip" is a password-protected ZIP archive that contains the EXE payload. It is an interesting example for this thread: [LIST=1] [*]The ZIP sample is detected by Microsoft Defender via BAFS (when downloaded from the URL or OneDrive). The detection is: Script/Ulthar.A!ml [*]This ZIP sample is not detected by AVs on VirusTotal (including Microsoft Defender). [*]The EXE file embedded in the ZIP sample is not detected by Microsoft Defender (I could also execute it on the computer with Microsoft Defender). [/LIST] [ATTACH type="full" alt="1661639042811.png"]268772[/ATTACH] [ATTACH type="full" alt="1661639861216.png"]268773[/ATTACH] This example shows that Microsoft Defender can sometimes block the attack in the wild when the initial malware is an archive from the Internet, and fail in the test with an EXE payload used in this attack. Such EXE files can increase an [B]"EXE test error"[/B] for Microsoft Defender. We cannot expect in all cases, that when Defender can block the attack in the wild, it can also block all EXE payloads that are going to be used in this attack. This example also shows that the Defender protection (default settings) is not comprehensive but rather very practical and focused on web threats. As we can see from VirusTotal, some popular AVs can detect the EXE payload that was missed by Defender, so they will not fail in the EXE test. [/QUOTE]

Verification