Lab

Ranstop stops zero-day, script-based Spora variant – TEMASOFT Lab Demo

Case subject – A zero-day Spora variant packed as a command line script

Today’s test uses a zero-day variant of Spora, disguised as a command line script. The file is distributed via email campaigns and, on execution, starts Microsoft Word and launches a background process that performs the actual encryption.

At the time of the recording, the package was not detected by any anti-virus engines listed on Virustotal and the payload was detected by 17 out of 61 solutions.

Case facts

TEMASOFT Ranstop detected the ransomware within several seconds, time in which the malware encrypted several tens of files. Next, the compromised files were recovered and, in parallel, the clean-up process removed the residual encrypted files and ransom notes. The malware executable was quarantined and an incident was logged in the TEMASOFT Ranstop Console.

Case Conclusion

TEMASOFT Ranstop managed to successfully block this zero-day ransomware packed in a way that eludes all anti-virus engines on Virustotal, and whose payload escapes most AV engines, at the time of the test.


Click here to watch TEMASOFT Ranstop in action (video)!

Virustotal details for the package;
Virustotal details for the payload;

About TEMASOFT Ranstop

TEMASOFT Ranstop is an anti-ransomware software that detects present and future ransomware, based on file access pattern analysis with a high degree of accuracy. At the same time, it protects user files so that they can be restored in case of malware attacks or accidental loss.

For more information, follow us on social media and subscribe to our newsletter.

This post was last modified on August 21, 2023 7:27 am

TEMASOFT FileMonitor Team

Share
Published by
TEMASOFT FileMonitor Team
Tags: ranstop

Recent Posts

The Role of File Monitoring Solutions in Maintaining File Integrity

In the digital world, information is often stored and transferred through files. From the most…

May 12, 2023

Guide to Conducting an Efficient File Access Permissions Audit for Admins and Technology Managers

Introduction Data security is more important than ever in today's fast-paced digital world. One critical…

April 9, 2023

File Integrity Monitoring: What It Is and Why It Matters

Introduction: Cyber threats are a growing concern for businesses and individuals alike. With the increasing…

March 5, 2023

Monitoring Essential Microsoft IIS Server Configuration Files for Enhanced Security

Microsoft Internet Information Services (IIS) is a popular web server that is widely used to…

February 25, 2023

Tracking file changes helps admins solve server configuration problems

File tracking is an important aspect of server administration, and it can help administrators detect…

February 1, 2023

Three reasons why admins should use file monitoring solutions

File monitoring solutions are essential tools for administrators to manage and protect their organizations' data…

January 6, 2023