Reply to thread

Message

<blockquote data-quote="WiseVector" data-source="post: 831986" data-attributes="member: 76851">Hi,1. The first sample is Ursnif malware which is banker trojan not RAT. Recently, we have done a lot of research on multiple Ursnif malware samples. They use sophisticated in-memory evasion techniques to fight aginst av. We will bring new Real-time Advanced Memory Inspection( as I mentioned in my previous reply) feature in the next version of WV to detect this kind of malware.Trust me, it&#039;s a real difficult task, since AI based deep memory analysis has performance issue. We must ensure the effectiveness, meanwhile the operating system can run fast as well.Please be patient to wait. Thank you.2. The second sample seems only connected to network without any further action. That means advanced detection does not have enough indicators to decide whether this file is malicious or not. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />If you have WiseVector StopX Real-time protection enabled, the running malware will be eliminated since the Real-time protection also includes basic memory analysis, not so powerful like deep memory analysis I mentioned above, but it is enough to detect this malware.Regards,WiseVector</blockquote>

[QUOTE="WiseVector, post: 831986, member: 76851"] Hi, 1. The first sample is Ursnif malware which is banker trojan not RAT. Recently, we have done a lot of research on multiple Ursnif malware samples. They use sophisticated in-memory evasion techniques to fight aginst av. We will bring new Real-time Advanced Memory Inspection( as I mentioned in my previous reply) feature in the next version of WV to detect this kind of malware. Trust me, it's a real difficult task, since AI based deep memory analysis has performance issue. We must ensure the effectiveness, meanwhile the operating system can run fast as well. Please be patient to wait. Thank you. 2. The second sample seems only connected to network without any further action. That means advanced detection does not have enough indicators to decide whether this file is malicious or not. :( If you have WiseVector StopX Real-time protection enabled, the running malware will be eliminated since the Real-time protection also includes basic memory analysis, not so powerful like deep memory analysis I mentioned above, but it is enough to detect this malware. Regards, WiseVector [/QUOTE]

Verification