Phrozen RunPE Detector is a security program, especially designed to detect and defeat some suspicious processes using a generic method.
The RunPE is a very simple and efficient method, most commercial anti-virus heuristic scans detect this trick, but not everybody thinks a good commercial anti-virus solution is money well spent. When you really understand the RunPE injection method, you can easily imagine a way to get rid of most of the possible versions by using a Memory PE Headers Scan of each process and comparing the Memory PE Headers to the Process Image Path PE Header version.
Since the Malware PE Header that has hijacked a legitimate process is very different from the legitimate process Image Path PE Header, we could detect the presence of a hijacked process.
RunPE is a technique that is used in several malicious ways
FWB (Firewall Bypass)
- As its name suggests, this technique is implemented to bypass or disable the Application Firewall or the Firewall rules. Since most malware needs to connect to a remote Command-and-Control (C&C) Server, it needs to connect to the Internet via the Firewall.
- Since most users are connected to the Internet at home, normally the installed Firewall would prevent the malware from connecting to the Internet. Using the RunPE technique to hijack a legitimate process that is authorized to reach Internet, any malware could subsequently connect to the C&C without being detected by the Firewall.
Malware Packer or Crypter
- Generally script kiddies – immature hackers — use a well-known type of malware that is already detected by most anti-virus programs. They then try the obfuscate this malware to evade detection. In order to achieve this, they need to buy programs such as a Packer or a Crypter. The price depends on its ability to evade anti-virus programs, update intervals, the number of extra functions, etc.
RunPE Detector scans PE headers for each process and compares the PE headers in memory to the PE headers in the process image path. This is a very simple method, but is also very efficient. Many commercial antivirus programs are capable of performing this scan, but Phrozen Software offers RunPE Detector as a standalone tool for performing scans manually or augmenting your custom cyber security suite.
We have tested RunPE against several of the most commonly-used types of malware and the detection rates are highly accurate. Because the RunPE technique is so commonly used with RATs, Trojans, Backdoors Crypters, and Packers, using RunPE Detector is a smart approach to ensuring your system is free of the most destructive types of malware.
OS: Windows XP / Vista / 7 / 8 / 8.1 / 10 (x86-x64)
Size: 2,60 MB.
Скачать | Download: