Malware Hub Report WiseVector StopX - January 2020 Report

[harlan4096]

WiseVector StopX - January 2020 Report

Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.

__

C: Clean / P: Protected / P - NC: Protected - Not Clean / I: Infected / E: Encrypted

* Dynamic BB Bonus Test (Real Time Protection Disabled)
* Partially Blocked
* BSR: Before System Reboot
* ASR: After System Reboot

January 2020	Samples Pack	Static Detection	Dynamic Detection	Total Detection	System Files Encrypted	2nd Opinion Scanners	System Final Status	Thread Link
02/01/2020​	8​	4 / 8​	1 / 4​	5 / 8​	No​	C​	P​	Post#2​
04/01/2020​	8​	8 / 8​	N/A​	8 / 8​	No​	N/A​	C​	Post#2​
06/01/2020​	2​	2 / 2​	2 / 2*​	2 / 2 2 / 2*​	No​	C​	P​	Post#5​
09/01/2020​	2​	2 / 2​	2 / 2*​	2 / 2 2 / 2*​	No​	C (NPE HMP) I (WV)​	C P - NC​	Post#5​
09/01/2020​	12​	12 / 12​	N/A​	12 / 12​	No​	N/A​	C​	Post#5​
10/01/2020​	2​	2 / 2​	2 / 2*​	2 / 2 2 / 2*​	No​	C​	C C*​	Post#3​
10/01/2020​	14​	13 / 14​	0 / 1​	13 / 14​	No​	C​	P​	Post#4​
13/01/2020​	4​	3 / 4​	0 / 1 3 / 3*​	3 / 3 3 / 3*​	No​	C​	P P*​	Post#3​
13/01/2020​	7​	5 / 7​	2 / 2​	7 / 7​	No​	C​	P​	Post#3​
13/01/2020​	2​	2 / 2​	1 / 2*​	2 / 2 1 / 2*​	No​	C​	C BSR: I* ASR: P*​	Post#4​
15/01/2020​	1​	1 / 1​	1 / 1*​	1 / 1 1 / 1*​	No​	C​	C C*​	Post#4​
15/01/2020​	16​	15 / 16​	1 / 1​	16 / 16​	No​	C​	P​	Post#4​
16/01/2020​	1​	1 / 1​	1 / 1*​	1 / 1 1 / 1*​	No​	C​	C P*​	Post#2​
17/01/2020​	3​	3 / 3​	2 / 3*​	3 / 3 2 / 3*​	No​	C​	C P*​	Post#2​
17/01/2020​	20​	17 / 20​	1 / 3​	18 / 20​	No​	C​	P​	Post#3​
19/01/2020​	2​	2 / 2​	2 / 2*​	2 / 2 2 / 2*​	No​	C​	C C*​	Post#4​
20/01/2020​	3​	3 / 3​	3 / 3*​	3 / 3 3 / 3*​	No​	C​	C P*​	Post#3​
21/01/2020​	13​	8 / 13​	1 / 5​	9 / 13​	No​	I (HMP) C (WV NPE)​	P​	Post#2​
22/01/2020​	2​	2 / 2​	2 / 2*​	2 / 2 2 / 2*​	No​	C​	C C*​	Post#2​
22/01/2020​	6​	6 / 6​	5 / 6*​	6 / 6 5 / 6*​	No​	C​	C P*​	Post#4​
22/01/2020​	1​	1 / 1​	1 / 1*​	1 / 1 1 / 1*​	No​	C​	C C*​	Post#2​
23/01/2020​	1​	1 / 1​	1 / 1*​	1 / 1 1 / 1*​	No​	C​	C C*​	Post#2​
24/01/2020​	15​	14 / 15​	0 / 1​	14 / 15​	No​	C​	P​	Post#2​
26/01/2020​	3​	3 / 3​	2 / 3*​	3 / 3 2 / 3*​	No​	C​	C P*​	Post#2​
27/01/2020​	11​	11 / 11​	N/A​	11 / 11​	No​	N/A​	C​	Post#2​
27/01/2020​	5​	5 / 5​	5 / 5*​	3 / 3 5 / 5*​	No​	C​	C BSR: I* ASR: P - NC*​	Post#3​
28/01/2020​	1​	1 / 1​	1 / 1*​	1 / 1 1 / 1*​	No​	C​	C C*​	Post#2​
28/01/2020​	3​	3 / 3​	2 / 3*​	3 / 3 2 / 3*​	No​	C​	C P*​	Post#2​
30/01/2020​	4​	4 / 4​	4 / 4*​	4 / 4 4 / 4*​	No​	C​	C C*​	Post#2​
31/01/2020​	16​	11 / 16​	5 / 5​	16 / 16​	No​	C​	P​	Post#3​

 

[oldschool]

WV still looking good. How do you like the new version?

 

[harlan4096]

I installed the 2.5 beta version leaked here by a user... the last results have been performed with that version, but it was not able to update in the last days, I always got an error (included yesterday test)... so I guess this beta version is not finished and stable yet... I will contact to @WiseVector about that...

 

[outlawxtorn]

I might have to make the jump to wisevector, seems like nothing gets past it. How's it on resources?

 

[harlan4096]

It is usually quite light... but I'm testing it in a VM...

 

[WiseVector]

I installed the 2.5 beta version leaked here by a user... the last results have been performed with that version, but it was not able to update in the last days, I always got an error (included yesterday test)... so I guess this beta version is not finished and stable yet... I will contact to @WiseVector about that...

Thank you very much for your ongoing testing and we have fixed some problems according to your tests.
Can WiseVector StopX update right now and what's the error in details?

 

[harlan4096]

It seems the issue still there, it takes a bit long and always I get that fail warning:

​

 

[WiseVector]

It seems the issue still there, it takes a bit long and always I get that fail warning:

View attachment 233162​

Sorry for the inconvience.
We have fixed the problem that may cause this. Please try again.

 

[harlan4096]

Thanks, it finally got stream updates!

 

[MacDefender]

Detection performance seems quite strong both for static and dynamic testing!


Are there any drawbacks/weaknesses you're seeing so far?

 

[harlan4096]

Starting from that there is no 100% detection... probably sometimes it can't detect some exploits inside some .doc, but new version 2.5 has added new detection features...

Also, there is no Web protection...

 

[Nagisa]

Unbelievably good. I wonder what makes WV that strong and why other big corps doesn't take the same route as WV did, using machine learning.

 

[harlan4096]

Many already do... but with different approaches...

 

[Nagisa]

Many already do... but with different approaches...

Seemingly, Wisevector's approach is quite different than others. It's a lot better, considering this product doesn't have signature based detection?

 

[MacDefender]

Unbelievably good. I wonder what makes WV that strong and why other big corps doesn't take the same route as WV did, using machine learning.

I also have noticed that ESET and Symantec both heavily use machine learning and they catch a lot of zero day malware variants. BitDefender's "Theta" engine is doing great on VirusTotal and that's AI/ML based too.

There are likely weaknesses to this approach too, just like machine learning based image recognition can be fooled by injecting specially crafted noise into a picture. But it's definitely exciting and a great approach.

 

[eonline]

hello, is the detection of signed malware good?

 

[harlan4096]

This one (recently posted in MWHub by @silversurfer) in concrete is detected, but in general I don't know since this type of malware is not so common to find...

​

 

[oldschool]

@harlan4096 how did you find the ransomware protection during your testing? What do you think of its implementation?

 

[harlan4096]

Do You mean behavioural or deception module?

 

[oldschool]

Do You mean behavioural or deception module?

Its behavioral Document Protection module. I starting getting "Allow/exclude" alerts about Windows processes,e.g. runtime broker, etc. and wasn't sure how to respond.