Comment by trog
4 days ago
Feels kind of weird that Windows Defender doesn't have something that catches this kind of behaviour? I mean if you have the Defender settings jacked up you're not going to be able to run executables anyway without a bunch of mucking around which should at least stop accidental running, but feels like some heuristics to stop these kinds of stealers should be a high priority for the Defender team. Not sure how you'd go about it though?
It's kinda funny because Windows Defender will catch some of these as Trojan:Win32/Ravartar!rfn
I find it funny that great minds think alike because I was just thinking of analysing these EXE files this week and doing a quick writeup at medium:
https://lazherrera.medium.com/analyzing-that-exe-file-youre-...
Defender automatically removes malware (or more correctly, game cracks it thinks are malware) the second it hits my disk from my torrent client.
But usually I'm downloading TV on Linux not windows
It's also great at cleaning up build artifacts of software I'm trying to compile before I even have a chance to run it. Wow! It was also very cool when it interfered with git in a way it couldn't detect, so I spent 2 hours diagnosing a bogus FS error.
Very cool Microsoft.