App Review This ransomware bypass every antivirus and removes antivirus

[XylentAntivirus]

He is not answering our questions.

Sorry for not answering questions, I was busy.

 

[Captain Awesome]

Sorry for not answering questions, I was busy.

No worries

 

[Szellem]

The malware is private malware like Solaris. I don't tested Comodo because he is clearly cheater due to auto containment but I bypassed him before.

This is tough!
You can kill the AVs pretty well. Unfortunately, AVs are a false sense of security. A lot depends on the User. Reading AndyFull, I prefer free Defender plus ASR rules.

 

[Andy Ful]

I prefer free Defender plus ASR rules.

ASR rules are OK, they can "raise the bar" for many attackers.
This malware can probably be prevented by Comodo Firewall (@cruelsister settings), Kaspersky (@harlan4096 settings), Avast with Hardened mode, etc.
In the home environment, also SmartScreen file reputation can be quite efficient.
However, no reasonable protection can stop the highly motivated attacker.

 

[Andy Ful]

This malware probably bypassed Avast's cloud sandbox.
It would be interesting to see if it could bypass the WDAC ISG (like in WHHLight).

 

[Digmor Crusher]

It would be interesting to see if it could bypass the WDAC ISG (like in WHHLight)

I wonder if there is someone on here who could test this for us?

 

[Szellem]

ASR rules are OK, they can "raise the bar" for many attackers.
This malware can probably be prevented by Comodo Firewall (@cruelsister settings), Kaspersky (@harlan4096 settings), Avast with Hardened mode, etc.
In the home environment, also SmartScreen file reputation can be quite efficient.
However, no reasonable protection can stop the highly motivated attacker.

Which Kaspersky setup do you mean that harlan4096 made?
Does the ASR Rule you posted also block user initiated safe mode?

 

[Andy Ful]

Which Kaspersky setup do you mean that harlan4096 made?

About Kaspersky, you should ask @harlan4096.

Does the ASR Rule you posted also block user initiated safe mode?

No (only CmdLine methods are blocked).

 

[Szellem]

No (only CmdLine methods are blocked).

This is very good news. I'll do it now.

 

[Andy Ful]

It would be interesting to see if it could bypass the WDAC ISG (like in WHHLight).

The initial malware can be most probably blocked by WDAC ISG before execution (due to the low prevalence). I can test it if someone would like to share the sample.
The ransomware dropped by the initial malware can be blocked by WDAC in Safe Mode if the sample is executed from a non-whitelisted location. The initial malware blocks the Internet connection before restarting in Safe Mode, so ISG cannot check the positive reputation and WDAC blocks the file.

 

[harlan4096]

Which Kaspersky setup do you mean that harlan4096 made?

 

[danb]

This file is blocked by WDAC ISG, along with all of the VoodooSoft products.

VirusTotal

VirusTotal

www.virustotal.com

 

[Szellem]

View attachment 287581

Thank you very much! Where to look for this, in Home products?

 

[harlan4096]

In Settings -> Security Settings -> Intrusion Prevention

 

[Szellem]

In Settings -> Security Settings -> Intrusion Prevention

I was inattentive. Thank you.

 

[Szellem]

The initial malware can be most probably blocked by WDAC ISG before execution (due to the low prevalence). I can test it if someone would like to share the sample.
The ransomware dropped by the initial malware can be blocked by WDAC in Safe Mode if the sample is executed from a non-whitelisted location. The initial malware blocks the Internet connection before restarting in Safe Mode, so ISG cannot check the positive reputation and WDAC blocks the file.

Andy! It would be really nice if you could test these samples as you write.

 

[XylentAntivirus]

I think I proved one malware enough to destory malware but that's rarely happens. I will test antiviruses aganist fully zero day harmful ip address. That would be too interesting than this because it's not only one malware it's too many urls.

 

[Szellem]

I think I proved one malware enough to destory malware but that's rarely happens. I will test antiviruses aganist fully zero day harmful ip address. That would be too interesting than this because it's not only one malware it's too many urls.

I think you've little bit misunderstand. Your evidence is fine.

What you should look at is what Andy described, in this case what's happening. And also how the Defender behaves in this situation.

 

[Captain Awesome]

I think I proved one malware enough to destory malware but that's rarely happens. I will test antiviruses aganist fully zero day harmful ip address. That would be too interesting than this because it's not only one malware it's too many urls.

Please test K7 Ultimate edition.

 

[XylentAntivirus]

I think you little bit misunderstand. Your proof is fine.
What you should look at is what Andy also described, in which case this does not happen. Also, how Defender behaves in this situation.

It detects by cloud right now probably but it didn't got deleted because Andy explanation is correct and we need use another method like Defender remover. But can't detect ransomware payload for some reason (I don't know is he going to detect final payload right now but when I tested in past it didn't get detected.).