Memory scan bypass?

[daniel keith 0]

i'm watching this youtube  

Is this a vulnerability?

 

[peteyt 396]

I'm not sure maybe report to eset via email. If you google the site eset seems to bring a warning up

[itman 1,746]

He's using NanoCore. It's a RAT that is usually delivered via e-mail and employs an exploit. As such, a vulnerability must exist for starters.

I really couldn't tell from the video how the malware was deployed if indeed it was. Didn't help that their was no audio. He was also running in a VM and malware plus AV software for that matter, do not always run as expected in a VM.

Also if this was a test of Eset's Advanced Memory Protection, it wasn't done right. AMS has nothing to do with Eset's AV manual scanning. AMS purpose is to detect post-execution after the malware has been loaded into memory.

Advanced Memory Scanner works in combination with Exploit Blocker to strengthen protection against malware that has been designed to evade detection by antimalware products through the use of obfuscation and/or encryption. In cases where ordinary emulation or heuristics might not detect a threat, the Advanced memory Scanner is able to identify suspicious behavior and scan threats when they reveal themselves in system memory. This solution is effective against even heavily obfuscated malware.

Edited April 21, 2017 by itman