New German Wiper Blocked By SandBlast Agent Zero Day Prevention

Gad_Naveh — Mon, 05 Aug 2019 14:38:06 GMT

A thread on bleeping computer describes an outburst of a new Wiper Malware. This wiper mimics Ransomware behavior but instead of encrypting the files it fills them with zeros (Nulls).

Our SandBlast Agent Anti-Ransomware zero day prevention detects and remidiate this attack without a need to update or signature usage.

The files are encrypted in our honeypot

File is indeed filled with Nulls and not possible to decrypt

SandBlast Agent Anti-Ransomware detects the ransomware process encrypting the files

SandBlast Agent restores the files

The infection is based on powershell script, I will move next to test this versus our File-Less infection prevention and update.

Thanks,

Gadi

topic New German Wiper Blocked By SandBlast Agent Zero Day Prevention in Endpoint

New German Wiper Blocked By SandBlast Agent Zero Day Prevention