Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 876797" data-attributes="member: 83059">I noticed something cool when revisiting my fake ransomware that used 7z.exe to ransom data. ESET now detects it as &quot;MSIL/Hoax.FakeFilecoder.FP&quot;So that begs the question: How is ESET going to respond to some variations in this binary? So here&#039;s some quick experiments:1. Changed just the string I print out at the end. It&#039;s now &quot;A Variant Of MSIL/Hoax.FakeFilecoder.FP&quot;[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/045328f8848ef588fb8af4e635b1d06e7facb2e5e8221bc4e258ec55714dbd2c/detection[/URL]2. Changed the file extension from &quot;.encrypted&quot; to &quot;.ransom&quot;. Still &quot;A Variant Of MSIL/Hoax.FakeFilecoder.FP&quot;[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file-analysis/ZmY2NmI0YWUxZWM0NWQ3M2Y0ZDU1YjhjMDk4OWUxMDk6MTU4Nzk0OTM5Nw==/detection[/URL]3. Split the arguments to 7zip:Before:[code]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string args = &quot; a -t7z -pransom -sdel &quot; + string.Format(&quot;\&quot;{0}\&quot; \&quot;{1}\&quot;&quot;, dst, src);[/code]After:[code]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string args = string.Format(&quot;{0} {1} {2} {3}&quot;,&nbsp; &quot;a&quot;, &quot;-t7z&quot;, &quot;-pransom&quot;, &quot;-sdel&quot;) + string.Format(&quot;\&quot;{0}\&quot; \&quot;{1}\&quot;&quot;, dst, src);[/code]No Detection:[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/61da77f7fb9410ab181147aab4fb1c583b379eb356a52256dfcae5af86de043a/detection[/URL]As a bonus test, I just fired up a new VM and created a new project, and copy-pasted the exact same C# code into it. Kind of puzzled: No detection either:[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/fa6375791eb901197cf3ae9ab4984e1691474b27a6ed038be0833b8f35b6ab4c/detection[/URL]It&#039;s an interesting look at the signatures that ESET produced for this file. As I expected, it will detect straightforward variations but it seems like they centered the detection around the arguments to 7zip, and if those are broken apart or reordered, even though the application does the exact same thing, a static scanner has a hard time being able to discern that.This is one of the gripes I have with static scanning. Many tools and methods exist for obfuscating code to make it difficult to statically inspect. What you ultimately cannot hide is the fact that this thing, on execution, will try to run 7zip. I would say a rule around using &quot;7z.exe&quot; with a -p (password) and a -sdel (source delete) argument should be considered highly highly suspicious. While it&#039;s normal to use 7zip, using it with those two arguments strongly implies something fishy is going on.NOTE: As a caveat, perhaps because they labeled this as a hoax, they do not consider it serious enough of a threat to produce high-quality signatures for.</blockquote>

[QUOTE="MacDefender, post: 876797, member: 83059"] I noticed something cool when revisiting my fake ransomware that used 7z.exe to ransom data. ESET now detects it as "MSIL/Hoax.FakeFilecoder.FP" So that begs the question: How is ESET going to respond to some variations in this binary? So here's some quick experiments: 1. Changed just the string I print out at the end. It's now "A Variant Of MSIL/Hoax.FakeFilecoder.FP" [URL unfurl="true"]https://www.virustotal.com/gui/file/045328f8848ef588fb8af4e635b1d06e7facb2e5e8221bc4e258ec55714dbd2c/detection[/URL] 2. Changed the file extension from ".encrypted" to ".ransom". Still "A Variant Of MSIL/Hoax.FakeFilecoder.FP" [URL unfurl="true"]https://www.virustotal.com/gui/file-analysis/ZmY2NmI0YWUxZWM0NWQ3M2Y0ZDU1YjhjMDk4OWUxMDk6MTU4Nzk0OTM5Nw==/detection[/URL] 3. Split the arguments to 7zip: Before: [code] string args = " a -t7z -pransom -sdel " + string.Format("\"{0}\" \"{1}\"", dst, src); [/code] After: [code] string args = string.Format("{0} {1} {2} {3}", "a", "-t7z", "-pransom", "-sdel") + string.Format("\"{0}\" \"{1}\"", dst, src); [/code] [B]No Detection:[/B] [URL unfurl="true"]https://www.virustotal.com/gui/file/61da77f7fb9410ab181147aab4fb1c583b379eb356a52256dfcae5af86de043a/detection[/URL] As a bonus test, I just fired up a new VM and created a new project, and copy-pasted the exact same C# code into it. Kind of puzzled: No detection either: [URL unfurl="true"]https://www.virustotal.com/gui/file/fa6375791eb901197cf3ae9ab4984e1691474b27a6ed038be0833b8f35b6ab4c/detection[/URL] It's an interesting look at the signatures that ESET produced for this file. As I expected, it will detect straightforward variations but it seems like they centered the detection around the arguments to 7zip, and if those are broken apart or reordered, even though the application does the exact same thing, a static scanner has a hard time being able to discern that. This is one of the gripes I have with static scanning. Many tools and methods exist for obfuscating code to make it difficult to statically inspect. What you ultimately cannot hide is the fact that this thing, on execution, will try to run 7zip. I would say a rule around using "7z.exe" with a -p (password) and a -sdel (source delete) argument should be considered highly highly suspicious. While it's normal to use 7zip, using it with those two arguments strongly implies something fishy is going on. NOTE: As a caveat, perhaps because they labeled this as a hoax, they do not consider it serious enough of a threat to produce high-quality signatures for. [/QUOTE]

Verification