PRODUCTS
RansomEye
“Ransomware analysis and agent management”
- Ransomware analysis through endpoint linkage
- Known Ransomware reputation verification
- Ransomware-only Yara signature detection
- Ransomware file comparison of similarity
Ransomware analysis
System overview
- RansomEye is a system that provides blocking, analysis and management functions in conjunction with the endpoint (RansomEye Agent). Ransomware suspicious file collected from RansomEye Agent provides analysis result through behavior analysis so, it is possible to know whether the normal file was detected as false. RansomEye dramatically reduced the rate of oversampling and false positives by comparing similarity of Ransomware files. RansomEye is a system that prevents network infiltration by blocking network traffic to the Ransomware distribution point and transit point.
System configuration
- Analyze behavior after collecting all file mirroring into the network
- Collecting files detected by RansomEye Agent Encryption Detection Sensor
- Analysis of file actions collected from RansomEye Agent
- Deploying RansomEye Agent detection, blocking policy management
RansomEye Features
Endpoint (RansomEye Agent) linkage analysis
- Provides analysis result through analyzing Ransomware suspicious file behavior collected from RansomEye Agent to check whether there is a normal file misjudgment
- Deploy blacklist policies for files identified by Ransomware as a result of behavior analysis
- Block Ransomware File by analyzing network inflow file
- Known Ransomware block from Location and sources of waypoint
Multi-step analysis detection
Deploying and managing RansomEye Agent policies
- Known Ransomware Blacklist Policy Deployment
- Deploying Ransomware Blacklist Policy by Detection
- Deploy Ransomware Similarity Detection Policy
- RansomEye Agent status information and statistics
build case
RansomEye Dashboard(1)
- Ransomware Domain Information
- Ransomware Infected Desktop Information
- RansomEye Agent Detect, block, and monitor status information
- Behavior Analysis Virtual Machine Status Monitor
- Ransomware distribution chart by country
RansomEye Dashboard(2)
- Ransomware Download Top 10 Information
- Ransomware File Similarity Comparison Top 10
- RansomEye Agent Detect, block, and monitor status information
- RansomEye Equipment status monitor
- Network traffic blocking monitor
Summary of behavior analysis results
- Summary of behavior analysis results
- File basics
- Summary of Sandbox Sensor Detection Information
- Yara Match Summary
- Dropped file summary
- Summary of Network Communication Attempt Detection Information
Behavior Analysis Report
- Virustotal reputation
- File basics
- Summary of Sandbox Sensor Detection Information
- Yara Match Summary
- Dropped file summary
- Network communication attempt detection information
RansomEye Agent
“Ransomware Blocking Agent”
- Blocks new and variant Ransomware.
- Multiple Sensors
- Maximizing the effectiveness when linking with the management server (RansomEye)
- Patent on detection method
Ransomware detection and blocking
System overview
- RansomEye Agent is an application for Windows that detects and blocks Ransomware. RansomEye Agent targets detection of RansomEye only, so detection rate is better than vaccine blocking program method. The RansomEye Agent is based on a stand alone installation, but it can maximize its effectiveness when linked with the management server (RansomEye). RansomEye Agent sends the detected and blocked Ransomware information to the management server (RansomEye) to check the result of the behavior analysis and check whether there is a false positive.
System configuration
- RansomEye Agent detects and blocks Ransomware when it infects user's PC
- Sends the detected file information to the management server (RansomEye)
- Receive Ransomware Block Policy from Management Server (RansomEye)
RansomEye Agent Features
Target, detect and block Ransomware.
- RansomEye Agent detects and blocks detection of Ransomware, so it has a better detection rate than other vaccine programs.
- Detects only the malicious code's cryptographic behavior, so it uses less system resources and does not slow down the system.
Multiple Sensors
Maximize effect when linking with management server (RansomEye) (optional)
- Check the behavior analysis results of Ransomware detected and blocked by RansomEye Agent and check whether there is false poses easily
- The management server (RansomEye) blocks the source of the Ransomware distribution on the network
- RansomEye Agent Management function
RansomEye Agent Video
Z-BLOCK
“Network-based malware detection”
- 27 million malware database-based scoring and similarity checks
- Local Sandbox behavior analysis
- Block IP / Block Domain / Block known C&C servers
- Perfect blocking with double reset (TCP Reset / Sinkhole)
- Acquired CC certificate of NIS (EAL 3)
Detect and block malware
System overview
- Z-BLOCK is a network based APT (Advanced Persistent Threat) detection and blocking system.
Provides real-time analysis and detection results for file and communication traffic coming into the network through the network. Minimizes false positives through the following four analysis / detection steps for all files.
1. All infiltrated files classify malicious code suspicious files through Yara rule matching (static analysis).
2. All incoming files are checked for malicious code similarity to determine similarity with existing malicious code.
3. All incoming files are analyzed through the local sandbox to determine if they are malicious.
4. Extract reputation results against 27 million malware reputation information databases you have.
In addition, Z-BLOCK can be linked with an endpoint (Agent) when necessary to maximize the accuracy of malicious code detection. (Patent on malicious code detection technique)
System overview
- Analysis of all file and communication packets flowing into the network after collecting mirrored behavior
- Block malicious codes detected by Z-BLOCK
- Blocks communication with known C & C servers
- Black domain, blocking by black IP registration
Z-BLOCK Features
Packet collection and blocking
- Stable packet collection in mirror mode without overloading the network
- In mirror mode, there is no impact on the network in the event of system failure (in the case of an in-line device, there is a disadvantage of being connected as a network failure in case of failure)
- Dualization blocking(TCP Reset / Sinkhole)
- GIGA network support
4-step multilevel analysis detection
Detection of similar malicious codes using fuzzy hash
- 27 million malicious code fuzzy hash information
- Malicious code of user type detected more than 60% similar value with existing malicious code
- Static analysis and hash value reputation show high detection rate in similarity
Perfect blocking by various blocking techniques
- Blocking using Sinkhole technique
- Blocking using TCP Reset
- Block using Fake DNS technique
Build Case
Z-BLOCK Dashboard(1)
- Malware Download Top 10 information
- Malware infected Desktop Top 10 information
- Malware Diffusion location chart by country
Z-BLOCK 대시보드(2)
- Malware Domain Top 10 information
- Malware File Similarity Comparison Top 10
- Z-BLOCK equipment status monitor
- Behavior Analysis Virtual Machine Status Monitor
- Network traffic blocking monitor
Summary of behavior analysis results
- Summary of behavior analysis results
- File basics
- Summary of Sandbox Sensor Detection Information
- Yara Match Summary
- Dropped file summary
- Summary of Network Communication Attempt Detection Information
Behavior Analysis Report
- Virustotal reputation
- File basics
- Summary of Sandbox Sensor Detection Information
- Yara Match Summary
- Dropped file summary
- Network communication attempt detection information
SandBox
“Detecting malicious code with Behavior analysis”
- Supports up to 128 virtual machines (defaults to memory specifications)
- Analysis of up to 42 file actions per minute with simultaneous multi-file analysis
- Provide Yara signature detection information
- Virustotal reputation information provided
- Dropped file information provided
- External network communication behavior detection information
Malicious file detection
Summary
-
Known malicious files coming in through the network are detected by signature (hash) and hash information, but unknown new and variant malicious files are detected by behavior analysis.
SandBox Features
Multi-file concurrent behavior analysis
- Analysis of up to 42 file actions per minute with multi-file concurrent behavior analysis (depending on the number of virtual machines)
Simultaneous operation of multiple OS
- Windows XP, Windows 7, Windows 10 Can be separately installed and driven
Performs behavior analysis by OS
- Ability to perform behavior analysis on desired OS
Behavior analysis report (example)
- Virustotal reputation
- File basics
- Summary of Sandbox Sensor Detection Information
- Yara Match Summary
- Dropped file summary
- Network communication attempt detection information
