Inside view: How DeepRay detects Emotet campaigns early

One of the most complex malware families in recent years is Emotet (see also: "Emotet - the all-purpose cyber crime weapon"). Emotet stands out especially because the authors produce new variants with high frequency. On a typical day, G DATA identifies 16 different variants of the malware via DeepRay. We then immediately tested the malware against the conventional signature engines of other providers.

The first provider we tested immediately detected eight of the 16 families distributed - just half. Apparently a signature was rolled out at around 11am that held up until the afternoon - but after that Emotet was ahead again. The next two providers did not detect a single variant to begin with. If a signature had ever been created, it would have already been too late. One provider identified a single variant, which doesn't put a dent into the numbers either.
The last provider also detected the Emotet variant from its signature for the first time at 11:09. However, this signature only lasted for three variants. The following two variants were not detected, the one after that was. Afterwards there was a detection hole again with  two variants that went undiscovered, whereupon the next five variants were detected. The protection failed again with the last variant. This is an example of the cat and mouse game typical of the AV industry. In the end, only 56 percent of the samples were detected at the outset.

DeepRay puts an end to exactly this kind of cat and mouse game, as well as the days of missed detections.  Where other providers sometimes had lengthy gaps in detection, G DATA was able to offer immediate protection with DeepRay.

The malware is identified by DeepRay directly in the main memory, where the malicious code has to show its true colors and has no way to hide. Consequently, DeepRay's Emotet detection has only had to be modified once in the past six months. For traditional providers, on the other hand, modifying the signature detection several times a day is the norm - or the attempt is abandoned immediately, or is released way too late.