In-the-wild Ransomware Protection Comparative Analysis 2016 Q3

WOW, thats great.....thanks markloman....

 

Perhaps MRG used this: hxxps://github.com/z7ev3n/ransomware as their simulated python ransomeware?

 

May i ask, whose post was removed? cruelsister's?

 

Yes. I read it 5 mins after she posted it and I personally saw nothing wrong with it. It was very interesting and very true.

 

HitmanPro commented previously on the methodology MRG used in this test in regards to reputation analysis. If a such testing is to be performed, it should be done using unknown 0-day samples.

The reason why? Many AV engines including some used by ZAM use "DNA" signatures. These are hybrid signatures developed to identify malicous code commonly used by malware. If the AV engine detects a match on a DNA signature, it will internally sandbox the process and perform further heuristic analysis upon it. In other words, no cloud reputation analysis is actually being performed at this point. If further suspicious process activity is encountered while being monitored, then cloud reputational analysis is performed. Therefore there is suspicion that the altered ransomware samples were actually initially detected by DNA signature, determined to be malicious by heuristic analysis, and no Zemana cloud reputation analysis actually
performed.