Defence Plus bypassed by Kraken botnet? [RESOLVED]

[Guest]

[Yuriy]

aigle,

Thanks for that malware. I receive exactly same results as you described in your first message when testing in my XP VM with CFP 3.0.22 BETA.

[salmonela]

I am not sure if my results are correct. Seems as file protection feature of Defence plus is bypassed. Here is how I reproduce it.

I executed malware.exe( Kraken botnet). I get these pop ups:

1- Exploere.exe trying to execute malware.exe- I allowed.

2- Malware.exe trying to modify itself- I allowed.

3- Malware.exe trying to create a randomly named executable in system32 folder- I denied but the executable was still created in system32 folder.

4- Malware.exe tries to execute the newly created execuatble in system32 foilder.

I noticed that if I deny second pop up and then deny 3rd pop up also, malware.exe is not able to create an executable in system32 folder but if I allow second popup and deny only 3rd pop up, malware.exe is able to create an executable in system32 folder. It seems so weired. Can anyone confirm this? PM me to get the malware.

BTW I did thid testing under Shadow mode of ShadowSurfer and I am still using an older version of CFP 3.0.18.309.

I can also confirm your findings aigle (VMware ,CFP 3.0.21.329, D+ paranoid, Image execution control - aggressive),
After allowing Malware.exe to modify itself, randomly created .exe is created in system32 folder (whatever your answer is), if you denied to Malware.exe modify itself, Malware.exe can be denied from creating randomly created .exe in system32 folder.

Thanks for your valuable findings here at Comodo forum 

[aigle]

By the way same findings with NeoavaGuard and ThreatFire though TF later caught the execuatble when it started from system32.

[salmonela]

Hmm it seems pretty common failure among "HIPS-like" defense,
What about our Chinese friends: EQsecure, Netchina S3, did you or someone from Wilders test these against Kraken maybe?

[aigle]

EQS was OK.

[salmonela]

I can all inform you that ↑above↑ reported "Kraken botnet issue" is solved in new 3.0.22.349 build...
 

[OD]

I can all inform you that ↑above↑ reported "Kraken botnet issue" is solved in new 3.0.22.349 build...
 

verified

OD

[aigle]

That,s nice.

[Josh123]

verified

OD

+1

Topic locked.

Josh

[Tags:]