RansomEye is a system that provides blocking, analysis and management functions in conjunction with the endpoint (RansomEye Agent).
Ransomware suspicious file collected from RansomEye Agent provides analysis result through behavior analysis so, it is possible to know whether the normal file was detected as false.
RansomEye dramatically reduced the rate of oversampling and false positives by comparing similarity of Ransomware files.
RansomEye is a system that prevents network infiltration by blocking network traffic to the Ransomware distribution point and transit point.
System configuration
Analyze behavior after collecting all file mirroring into the network
Collecting files detected by RansomEye Agent Encryption Detection Sensor
Analysis of file actions collected from RansomEye Agent
Provides analysis result through analyzing Ransomware suspicious file behavior collected from RansomEye Agent to check whether there is a normal file misjudgment
Deploy blacklist policies for files identified by Ransomware as a result of behavior analysis
Block Ransomware File by analyzing network inflow file
Known Ransomware block from Location and sources of waypoint
Multi-step analysis detection
Deploying and managing RansomEye Agent policies
Known Ransomware Blacklist Policy Deployment
Deploying Ransomware Blacklist Policy by Detection
Deploy Ransomware Similarity Detection Policy
RansomEye Agent status information and statistics
build case
RansomEye Dashboard(1)
Ransomware Domain Information
Ransomware Infected Desktop Information
RansomEye Agent Detect, block, and monitor status information
Behavior Analysis Virtual Machine Status Monitor
Ransomware distribution chart by country
RansomEye Dashboard(2)
Ransomware Download Top 10 Information
Ransomware File Similarity Comparison Top 10
RansomEye Agent Detect, block, and monitor status information
RansomEye Equipment status monitor
Network traffic blocking monitor
Summary of behavior analysis results
Summary of behavior analysis results
File basics
Summary of Sandbox Sensor Detection Information
Yara Match Summary
Dropped file summary
Summary of Network Communication Attempt Detection Information
Behavior Analysis Report
Virustotal reputation
File basics
Summary of Sandbox Sensor Detection Information
Yara Match Summary
Dropped file summary
Network communication attempt detection information
RansomEye Agent
“Ransomware Blocking Agent”
Blocks new and variant Ransomware.
Multiple Sensors
Maximizing the effectiveness when linking with the management server (RansomEye)
Patent on detection method
Ransomware detection and blocking
System overview
RansomEye Agent is an application for Windows that detects and blocks Ransomware.
RansomEye Agent targets detection of RansomEye only, so detection rate is better than vaccine blocking program method.
The RansomEye Agent is based on a stand alone installation, but it can maximize its effectiveness when linked with the management server (RansomEye).
RansomEye Agent sends the detected and blocked Ransomware information to the management server (RansomEye) to check the result of the behavior analysis and check whether there is a false positive.
System configuration
RansomEye Agent detects and blocks Ransomware when it infects user's PC
Sends the detected file information to the management server (RansomEye)
Receive Ransomware Block Policy from Management Server (RansomEye)
RansomEye Agent Features
Target, detect and block Ransomware.
RansomEye Agent detects and blocks detection of Ransomware, so it has a better detection rate than other vaccine programs.
Detects only the malicious code's cryptographic behavior, so it uses less system resources and does not slow down the system.
Multiple Sensors
Maximize effect when linking with management server (RansomEye) (optional)
Check the behavior analysis results of Ransomware detected and blocked by RansomEye Agent and check whether there is false poses easily
The management server (RansomEye) blocks the source of the Ransomware distribution on the network
RansomEye Agent Management function
RansomEye Agent Video
Z-BLOCK
“Network-based malware detection”
27 million malware database-based scoring and similarity checks
Local Sandbox behavior analysis
Block IP / Block Domain / Block known C&C servers
Perfect blocking with double reset (TCP Reset / Sinkhole)
Acquired CC certificate of NIS (EAL 3)
Detect and block malware
System overview
Z-BLOCK is a network based APT (Advanced Persistent Threat) detection and blocking system.
Provides real-time analysis and detection results for file and communication traffic coming into the network through the network. Minimizes false positives through the following four analysis / detection steps for all files.
1. All infiltrated files classify malicious code suspicious files through Yara rule matching (static analysis).
2. All incoming files are checked for malicious code similarity to determine similarity with existing malicious code.
3. All incoming files are analyzed through the local sandbox to determine if they are malicious.
4. Extract reputation results against 27 million malware reputation information databases you have.
In addition, Z-BLOCK can be linked with an endpoint (Agent) when necessary to maximize the accuracy of malicious code detection. (Patent on malicious code detection technique)
System overview
Analysis of all file and communication packets flowing into the network after collecting mirrored behavior
Block malicious codes detected by Z-BLOCK
Blocks communication with known C & C servers
Black domain, blocking by black IP registration
Z-BLOCK Features
Packet collection and blocking
Stable packet collection in mirror mode without overloading the network
In mirror mode, there is no impact on the network in the event of system failure (in the case of an in-line device, there is a disadvantage of being connected as a network failure in case of failure)
Dualization blocking(TCP Reset / Sinkhole)
GIGA network support
4-step multilevel analysis detection
Detection of similar malicious codes using fuzzy hash
27 million malicious code fuzzy hash information
Malicious code of user type detected more than 60% similar value with existing malicious code
Static analysis and hash value reputation show high detection rate in similarity
Perfect blocking by various blocking techniques
Blocking using Sinkhole technique
Blocking using TCP Reset
Block using Fake DNS technique
Build Case
Z-BLOCK Dashboard(1)
Malware Download Top 10 information
Malware infected Desktop Top 10 information
Malware Diffusion location chart by country
Z-BLOCK 대시보드(2)
Malware Domain Top 10 information
Malware File Similarity Comparison Top 10
Z-BLOCK equipment status monitor
Behavior Analysis Virtual Machine Status Monitor
Network traffic blocking monitor
Summary of behavior analysis results
Summary of behavior analysis results
File basics
Summary of Sandbox Sensor Detection Information
Yara Match Summary
Dropped file summary
Summary of Network Communication Attempt Detection Information
Behavior Analysis Report
Virustotal reputation
File basics
Summary of Sandbox Sensor Detection Information
Yara Match Summary
Dropped file summary
Network communication attempt detection information
SandBox
“Detecting malicious code with Behavior analysis”
Supports up to 128 virtual machines (defaults to memory specifications)
Analysis of up to 42 file actions per minute with simultaneous multi-file analysis
Provide Yara signature detection information
Virustotal reputation information provided
Dropped file information provided
External network communication behavior detection information
Malicious file detection
Summary
Known malicious files coming in through the network are detected by signature (hash) and hash information, but unknown new and variant malicious files are detected by behavior analysis.
SandBox Features
Multi-file concurrent behavior analysis
Analysis of up to 42 file actions per minute with multi-file concurrent behavior analysis (depending on the number of virtual machines)
Simultaneous operation of multiple OS
Windows XP, Windows 7, Windows 10 Can be separately installed and driven
Performs behavior analysis by OS
Ability to perform behavior analysis on desired OS
Behavior analysis report (example)
Virustotal reputation
File basics
Summary of Sandbox Sensor Detection Information
Yara Match Summary
Dropped file summary
Network communication attempt detection information
BaileyTech is specialized in Ransomware and APT (Advanced Persistent Threat) detection and blocking solutions, and is committed to protecting your valuable information.
Since it was established in 2012, we have acquired the CC certification of Z-BLOCK equipment in 2016 through continuous research and development. We have established the foundation of company growth by securing government, public institutions, universities, hospitals and large companies as references.
In January 2017, we released 'RansomEye', a Ransomware detection prevention solution.
'RansomEye' is a solution to detect the Ransomware by maximizing the detection rate of RansomEye by introducing the self-developed quadruple detection sensor method such as encryption step and abnormal action step detection on the user PC by the detection blocking method by linking with network and end point (Agent).
BaileyTech will continue to devote itself to becoming an information security specialist whose primary concern is to protect your information.
History
2017
01 Ransomware detection and blocking solution 'RansomEye' Launching
2016
11 Selected as the best company for NICE technology evaluation
05 Supplied Z-BLOCK to Ministry of Culture, Sports and Tourism