For whatever is worth (i'm no expert in av's or av testing whatsoever), some months ago I was considering to subscribe to an AV, and did a test: wrote a simple program that would delete everything in the Desktop and Documents folder as soon as it was executed, without any warning or consent (something that i definitely wouldn't want to happen in my computer). Then I put some folders and files in the Documents and Desktop folders, and proceeded to execute the program. Tested with several AV's, and Emsisoft was the only one that, even though not totally, blocked it. The behavior blocker kicked in, and stopped it. Some files were still deleted, but still most were preserved. I was honestly very surprised that Emsisoft was the only one that stopped that action. I've tested this in a VM, by manually putting the program in the desktop and running it. Maybe in other scenarios (like if the file was downloaded from a website) the other AV's I've tried would block it too. Like I said, I'm no expert in AV testing and did this by curiosity while considering to buy an AV.
Just for fun I repeated that test today. Used Visual Studio to make two C# applications:
(1) Simulated ransomware: creates a simple password protected zip file of Desktop and My Documents then goes and deletes files one by one.
(2) Simulated generic malware: upon running downloads a second binary from my web server and executes that. The second binary copies itself to another location and then tries to register that as a startup item.
I had Symantec Endpoint Protection, F-Secure SAFE, and Emsisoft virtual machines around for testing.
All 3 flagged the second one — F-Secure and Emsisoft caught it as it attempted to download and execute the second payload. SEP flagged it after it attempted to register as a startup item.
The simulated ransomware test was super interesting. F-Secure flagged it as a DeepGuard detected cryptoransomware, and pointed out specifically it was because it was manipulating files in a protected folder. Emsisoft also flagged it as suspicious behavior (nothing specific) and started a 10 second countdown before deleting it. SEP was totally silent as was the default settings for Windows Defender.... that was kind of shocking to me since SONAR is regarded as a great behavior blocker. I even tried adjusting as many of the SONAR and heuristics/Bloodhound settings as I could find, no change.
I’m also not a malware tester, I am an application developer by day. But for me this definitely influences my decision — especially since the first test actually resulted in losing all my simulated files with Windows Defender and SEP.
Just as a disclaimer, I didn’t spend much time trying more creative ways of encrypting user data. Most real ransomware use more clever tactics than the first StackOverflow result for zipping up files in a directory....
I am also a bit disappointed in static heuristic analysis by all of these programs. Looking at the disassembly it is fairly obvious what it is doing — less than half a page of IL assembly and references to password protected encryption, getting My Documents location, looping through files.
