Skip to main content
6 events
when toggle format what by license comment
Apr 21, 2016 at 9:19 comment added Steffen Ullrich @Danny: from the link to CryptoMonitor it looks more like the use of Honeydocs (which ransomware likes to access) called "Entrapment Protection" and some vague specified heuristics to detect suspicious processes "Count Protection". Only the latter feature has some overlap with RansomWhere, i.e. both tools share some ideas (trusted processes, I/O anomalies) but not all.
Apr 21, 2016 at 7:56 comment added Danny. Of Course MB is not telling how their product is working in detail. But to get a better Feeling just have a look at the CryptoMonitor tool (e.g. bleepingcomputer.com/forums/t/572146/…) There you can find some indications about how it can work (I expect MB has adopted the tool - so some functionality is still in place)
Apr 21, 2016 at 7:37 comment added RLFP The details on whether this is actually the same approach is not clear. It is however a good indicator that they do not use signatures, but it is not verifiable that this is the same strategy.
Apr 21, 2016 at 7:23 comment added Steffen Ullrich Unfortunately I cannot find any deeper details about how this works so it is hard to compare if this is really the same idea. Do you have more information?
Apr 21, 2016 at 7:08 history edited Danny. CC BY-SA 3.0
added 184 characters in body
Apr 21, 2016 at 7:02 history answered Danny. CC BY-SA 3.0