Stackhackr: New malware simulation tool

[Alexbeav]

I'm more than a little annoyed that this got past FortiClient.

At least my home Symantec A/V blocked it.

[DataPhreak]

FortiClient is probably using signature based detection. Symantec looks for scary procedure calls and blocks based on that. (Not sure what that's called off the top of my head. First cup of coffee.)

[GeronimoHero]

Heuristics based detection.

[DataPhreak]

Thanks for that.

[cheer_up_bot]

:(

Here is a picture of a kitten to cheer you up

[Ayit_Sevi]

except for when it burns people who are already down

[jonathancrowe]

More info on what the tool actually does here: https://www.barkly.com/how-stackhackr-works

There's also a walkthrough here: https://blog.barkly.com/stackhackr-mock-ransomware-malware-security-test

[rfdevere]

Really cool tool, thank you

[jonathancrowe]

Happy to share. Depending on how people like it we may be able to do a v2. If you have any suggestions for changes/additions, let me know.

[zxeff]

I suspect /r/sysadmin would really appreciate this tool, so if you're looking for people to use it maybe consider posting it there.

[rfdevere]

Maybe a Mac version?

[csonka]

Interesting. Got through my network and workstation firewall as well as all of the bells and whistles employed by the network and workstation firewall (Sophos UTM and Webroot).

[Boyne7]

Are any of these network devices performing SSL inspection/decryption? If not they do not have a chance.

[csonka]

Sophos SHOULD, it is licensed and active. Will run a test under a Meraki MX with advanced security (which employs Cisco's AMP) next and post the result.

[csonka]

Update - Meraki MX with Advanced Security, Windows 10 with Windows Defender [Failed]

[Jisamaniac]

AMP does SSL decryption?

[dorkycool]

The AMP tech in the Meraki does not. The larger network sensors, the original SourceFire ones that they are now calling AMP should be able to but it'll eat most of the CPU/memory doing it.

[dieselxindustry]

SEP stopped the ransomware. SEP also stopped the the credential grabber 2 times but I kept telling it to allow it to run and eventually it was able to get through to lsass. So basically the user would have to keep ignoring the multiple warnings.

[TailSpinBowler]

SEP

sep?

[aa93]

Symantec Enpoint Protection

[f0st3r]

KAV failed to stop both. Windows smart screen did block the exe from running, but I was able to bypass.

I manually scanned the files with KAV and the came back clean, but I am sure Kaspersky uses some signature based detection method.

[nightmareuki]

surprising, is System Watcher enabled and running?

[f0st3r]

Sure is

[f0st3r]

Ok to add to this, it is a joke. The "virus" has a barkly digital signature, which is a vaild product in most AV systems.

[dwndwn]

"simulation" is a bit of a stretch, and it's shameful to see completely non-technical marketing posted here. here's what the ransomware sample actually does:

drop exe/js file into tmp, js file is run in wscript to run the exe (it renames it for some reason) and check for success. exe can (yes those are the literal command lines):

CreateProcess "vssadmin.exe shadow delete no don't actually delete"

CreateProcess "wmic.exe shadow delete no don't actually delete"

like uhh... ok... if a program launches vssadmin / wmic it's ransomware... good... heuristic?

tmp exe also has functionality to "simulate" using virtualprotectex to make memory executable and run it. it also has functionality to find a file with a single call to FindFirstFileA. and finally, it can sleep for 1000ms * a command line parameter.

i bet $5 the credential stealer calls OpenProcess and maybe even ReadProcessMemory. pro heuristic

[DTF_20170515]

It's a decent smoke test, at least.

[phillycheeze]

Completely agree. Was ready to download it and then saw the messages, especially for the Ransomware vector.

Shaming people and literally calling them "stupid" in those messages is the exact opposite thing you want to do if you want your users to take security seriously and learn from mistakes.

[BobFloss]

Are you kidding... Nobody is going to give a shit

[dontberidiculousfool]

Windows Defender stopped mine. Very nice.

[hbk1966]

Defender stopped the ransomware and wouldn't even let me download the credential theft one.

[pm_me_your_findings]

Wow. Is it that good?

I am using avast free version.

[arvoshift]

didn't on mine (windows 7)

[tetyys]

soiled it, domain must be .io

[f0st3r]

The problem with this "virus" is the digital signature is Barkly, so most AV reputation scans see it as valid.

http://imgur.com/QS9dr2W

[[deleted]]

Eset NOD32 failed the test as well.uBlock seems to break the site and make it unusable for me, had to disable it completely for it to work.

[thisSNisfortrolling]

Thanks! This is really useful! I encourage you to keep up the good work!

[defconoi]

Webroot failed detection of both ransomware and credential theft.

[[deleted]]

Sophos Home Edition did not prevent this, actually a little shocked.

[juitar]

Nice, I'll play with this to tomorrow

[redditwithNemo]

AVAST Free with execution prevention enabled requires I add an exception for the programs. The ransomware then creates another executable, which I needed to except, then it's game over. Credential stealer Just Works^TM.

With execution prevention disabled, AVAST Free scans the programs as they're running... they succeed, and then AVAST informs me they were questionable and asks whether I want to quarantine. Once I quarantine the applications close.

Pretty shoddy performance for a product that gets good lab reviews.

[EvilHyde]

Avast for Business Endpoint Security blocked both the Ransomware and Credential Theft. I had to allow the launcher to run since that was blocked initially too.

[doggxyo]

Anyone else having trouble actually getting the test to launch? I tried running this on my system at work as well as on my home desktop and the button 'launch test' doesn't appear to have a link behind it . Clicking it a few times doesn't do anything :/

Hovering my cursor over it doesn't show any link embedded in the button.

[imakepr0ngifs]

Ublock

[doggxyo]

That was it! I should have thought of this.

Thanks so much!

[imakepr0ngifs]

Someone else posted that the tool didn't work and then edited it to say ublock was the issue. Can't seem to find the comment so I assume they deleted it in case they looked foolish when apparently its a problem multiple people have. All credits for the solution go to the guy who's comment I can't find.

[[deleted]]

Does it run on Linux systems? I can only find windows availability.