mamutu VS the four virus of king

first I am sorry for my poor enghlish, I cant translate my post to english. someone message me to post the test about mamutu. I try translate it use google, so maybe has many mistake.

Test samples: 1, sample source

~Links removed. No links to malware or possible malware are allowed on the forums. - Ron~

test1

virus nameanda

mamutu carcass was hidden virus installation(pic1-3)

now we allow the opreation of install invisible, and check wheather mamutu can bloke it or pass.

well done, mamutu alram that virus try to creat autorun(see pic4-5). this is a typical beheave of virus.

 

test2

virus name:xiaohao

mamutu carcasses at the same installation of hidden Xiao-hao



let's allow the install invisible, now I find mamutu no any react , the virus run seccusfully.





mamutu can block the virus when the first alram, but mamutu will be passed if allow the install invisible. But hidden installation is a typical behavior of Trojan horses, I think mamutu carcasses or successfully intercepted a Xiao-hao.

 

test3

virus name:drives monster

also install invisible(pic1-2)

allow the install invisible, we can see the lsass.exe want install invisible, we can easy find this lsass is a virus file because it is wrong file path.(pic3)

Successful interception, floppy drives are KO

 

test4

virus name:crazy robdog

mamutu carcasses reported on the first step to amend other processes, this is a dangerous beheave and need to be blocked.(pic1)

and robdog will creat autorun entry when I allow the first step. typical trojam beheave.(pic2)


Successful interception, the dog was KO

From the above four simple tests, the virus mamutu interception capabilities beyond my expectations, even a 100% successful. It seems mamutu is a worthwhile beheave--base softwore.

 

Bearzake

Thanks for posting. Your English is way better than my Chinese

 

Bearzake thank you for taking the time to do this test very well done indeed keep up the great work

 

Good work baerzake, thanks.

 

thank you all guys ^_^
but I found mamutu has some weakness that the self-protection of mamutu is not very good.

 

Well-worded, I tested a-squared Anti-Malware against oldie DFK Threat Simulator v2 a few months ago.
Dead on arrival, only an infected adulteration was left behind.

I posted my test in the german section of Emsisoft forums, no reply up to today.
There seems to be room for improvement.

Cheers

 

What does invisible install by Mamutu means?

I wonder how well TF and PRSC will stand against these viruses.

 

Hi,

If I remember correctly, on the same forum where Baerzake published his report,

TF passed all four, same result as Manutu, while

PRSC(or NAB) failed two of four.

 

Thanks Perman.

 

So A-Squared Anti-Malware would be able to block the same threats? I know it shares the same technology with Mamutu.

 

The self protection has been significantly improved in version 1.5 that was published a few weeks ago. Could you please run another test like the one mentioned?

I'm sorry that you didn't get a timely reply in our forum. Which thread do you mean?

 

good news

 

create auto start entry, invisible install, manipulate other process
it is commonly seen and can be covered by any HIPS, you will see prompt if the HIPS is noisy, ask you whether allow this unknown exe, any action may change system key point or dangerous behavior is been notified.

 

http://forum.emsisoft.com/Default.aspx?g=posts&t=2929

Well, this is not easy to understand, because I remember your reply at Rokop Security about two months ago.
I assume that was you.
http://www.rokop-security.de/index.php?s=&showtopic=15829&view=findpost&p=226756

As everyone can come round to another opinion, that's not an issue.
An issue for every security program is a weak self protection, in my opinion.
If there are improvement, I'll be the first to acclaim such development.
Unfortunately baerzake's statement about mamutu's self protection was of a different opinion.

Cheers

 

Mamutu

 

why is mamutu so good. What makes it better?

 

For now, it has done well in the tests I have seen, it is very easy to set up and maintain , especially with Intelligent Alert Reduction checked. It knows how to make most choices for you, compared to Threatfire. And the combo with Sandboxie and Avira is running very fast, since everyone here makes this a big deal. Is it the best, no. Is it good and getting better with a good support team. Hell yes.

 

There are better products for free. I tried A Sqaured real time mode and it used 62K of memory. No need for such a big foot print. Comodo and OA can do the same for free. I also use Avira with all files selected.

 

Intelligent alert reduction mode will reduce the detection qualiy almost 50% when I test , I dont recommaned use this mode, community-base mode is the best to use for arevage users.

 

thanks

 

wow,I found the self-protection of mamutu already improved right now
but is still not perfect. see the test pic.
TEST1

use "taskkill" to terminate the process of mamutu. we can see that mamutu is good, taskkill cant terminate the process.



TEST2

use advance process terminator to terminate the process of mamutu. we can see the process is not terminated by user-mode and crashing. well done



and second I try terminate it by APT's kernel-mode, this mode use the drive to terminate the process, we can see that mamutu alarm when kernel-mode test, that is good


BUT the weakness of mamutu' self -protection is the process "mamutu.exe".
it can be terminated by APT's user-mode, it is dangerous. the most important of all is mamutu is dead when mamutu.exe be terminated, the a2service still running but no any reaction. . we can see that a2service.exe can be terminated by kernel-mode and no alarm after mamutu.exe had been terminated.

 

Hi,

I tested Mamutu against the TrojanSimulator, which is recommended by Christian Peters in this thread:
http://forum.emsisoft.com/Default.aspx?g=posts&t=2939

Mamutu 1.5.0.22 passed this test as you can see:



Therefore it should work as expected.
Then, logged in as admin, I tried to end mamutu.exe in Windows Task-Manager, which can be done easily.
Afterwards (only a2service.exe is running) the TrojanSimulator can install its trojan server TSServ.exe without any interrupts by Mamutu.

BTW the Mamutu Service runs apparently as an ordinary service, as far as I can see the only protection is to restart if it fails.
Simple run "net stop mamutu" and it will not restart again.
This works even if Mamutu (mamutu.exe) is running, "net stop mamutu" kills both processes (mamutu.exe and a2service.exe).

These findings are of course meaningless related to a "real maleware attack", but show a little impression about general self protection, in my opinion.

Cheers