Timeline for Would a RansomWhere application be possible for Windows too?
Current License: CC BY-SA 3.0
6 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Apr 21, 2016 at 9:19 | comment | added | Steffen Ullrich | @Danny: from the link to CryptoMonitor it looks more like the use of Honeydocs (which ransomware likes to access) called "Entrapment Protection" and some vague specified heuristics to detect suspicious processes "Count Protection". Only the latter feature has some overlap with RansomWhere, i.e. both tools share some ideas (trusted processes, I/O anomalies) but not all. | |
Apr 21, 2016 at 7:56 | comment | added | Danny. | Of Course MB is not telling how their product is working in detail. But to get a better Feeling just have a look at the CryptoMonitor tool (e.g. bleepingcomputer.com/forums/t/572146/…) There you can find some indications about how it can work (I expect MB has adopted the tool - so some functionality is still in place) | |
Apr 21, 2016 at 7:37 | comment | added | RLFP | The details on whether this is actually the same approach is not clear. It is however a good indicator that they do not use signatures, but it is not verifiable that this is the same strategy. | |
Apr 21, 2016 at 7:23 | comment | added | Steffen Ullrich | Unfortunately I cannot find any deeper details about how this works so it is hard to compare if this is really the same idea. Do you have more information? | |
Apr 21, 2016 at 7:08 | history | edited | Danny. | CC BY-SA 3.0 |
added 184 characters in body
|
Apr 21, 2016 at 7:02 | history | answered | Danny. | CC BY-SA 3.0 |