Protect against malware Adrozek?

Question

Good afternoon, 
 
 I would like to confirm if the machine-learning feature of Sophos can protect us againts the new major browser malware Adrozek. 
 Further information about can be find here: 
 https://arstechnica.com/information-technology/2020/12/ongoing-malware-attacks-are-hitting-users-of-4-major-browsers/ 
 Detailed one : https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers 
 My understanding is that a standard signature protection can't beat the countermesure Adrozek are taking. 
 Also I'm not sure blocking Audiolava.exe, QuickAudio.exe, and converter.exe can a real protection here. 
 That said, in this one I need your help to tell me if Sophos already have something against it or if I need to look at something else to block it. 
 Regards,

RichardP · Accepted Answer

Hi David, 
 As Glenn stated - we are using both forms to detect the malicious element. So, for some scenarios the static detection will prevent the action and in others (based on how the malware is executing) the ML portion of the product will catch it. In general, we use a Defense in Depth approach to our product to provide optimal protection.

GlennSen · Answer

Hi David Grandolfo , Based with our labs team confirmation, we are detecting the files through generic malware detection (Troj/Agent-BEQV) and also through ML based detection. In addition There is no mention of hashes or IPs on Microsoft blog. To help us strengthened the protection that we can offer for this type of Malware, Please submit to us any sample file related to this malware in order for our labs team to further check to it.

Protect against malware Adrozek?

Top Replies