ESET Anti-Ransomware Setup

In this Tech Brief we describe the optimal settings of our ESET security solutions against the current form of ransomware and the most common infection scenarios. The goal is to protect our customers even better against a ransomware outbreak where valued data can be encrypted and/or held hostage, only to be released after a ransom is paid.

Current ransomware attacks use advanced infection techniques allowing malicious malware to infect your device. They persuad people to execute a so-called dropper which in turn will download the malicious malware payload to start the encryption process. By attaching the dropper to an email, cybercriminals try to prevent detection at entry.

In most cases a properly constituted phishing mail is used with a ZIP file as attachment. This ZIP file most commonly contains a JavaScript file of the type .JS. Because JavaScript is used by numerous websites, it is impossible to block in the browser. Besides that, Windows also executes JavaScript directly.

Meanwhile the JavaScript code in the dropper is heavily obfuscated, defaced and continuously modified in order to prevent detection. This gives us the opportunity to influence the execution of potentially malicious code through standard processes, by using various security modules.