Sophos Home Premium vs Ransomware [Failed]

Hi Enrick Ordono 

I have watched the video provided here and found that the user who is running showing the ChineseRarypt is a bat file, doesn't seem to be actual ransomware.

As you mentioned, it just deletes the images from my picture folder. It didn't encrypt the any of the folders under C drive

Also, the person who has captured the video has put the exception for processhacker.exe and iobitunlocker.exe in the setting.

Until we have any sample of this, we can't say whether it was actual ransomware and It was not utilizing process hacker or any excluded utilities.

I don't know if this will help any, but in the Kaspersky video, which I will link, the supposed ransomware does go through its malicious actions, but Kaspersky does detect it in the end when it tries to embed itself into startup. Kaspersky gave the option to initiate rollback and disinfection, but the procedure couldn't roll back everything, including the "encryption." https://youtu.be/pwIej9duBhw On another note, the fact that this batch file only deleted files is a valid concern for suspicion that this may not be actual ransomware. But upon looking at his other videos, another ransomware works this way. MirCop ransomware encrypts then deleted files during its attack. In a video I will link, it is tested against ZoneAlarm Anti-Ransomware where the product succeeds. https://youtu.be/ENAClP0-YZY

I don't know if this will help any, but in the Kaspersky video, which I will link, the supposed ransomware does go through its malicious actions, but Kaspersky does detect it in the end when it tries to embed itself into startup. Kaspersky gave the option to initiate rollback and disinfection, but the procedure couldn't roll back everything, including the "encryption." https://youtu.be/pwIej9duBhw On another note, the fact that this batch file only deleted files is a valid concern for suspicion that this may not be actual ransomware. But upon looking at his other videos, another ransomware works this way. MirCop ransomware encrypts then deleted files during its attack. In a video I will link, it is tested against ZoneAlarm Anti-Ransomware where the product succeeds. https://youtu.be/ENAClP0-YZY

Hi Enrick Ordono 

Thank you for both the videos. I am not aware of how Kaspersky works for ransomware detection.

But in general, ransomware gets detected by the AVs when there is a rapid change in the header, name of the files and etc.

Also, as ZoneAlarm restored the files after clicking on repair if Sophos detects ransomware attack, it replaces the number of encrypted files(which could be very less) before attack was detected with the original file without any option for repair.