You are right about everything. Kaspersky and ESET have very accurate detection. If you see a detection from them on VT, then that file is probably malicious. I always check them first to see the detection.
A interesting fully undetectable malware (until now)
- Thread starter HydraDragonAntivirus
- Start date
- Status
I find a issue on my side and fixed. I think it should detect right now because I broke code before.
First look the ClamAV detection. It's pretty reliable. You can extract with 7zip. Then you see this probably:
Ask ChatGPT then. It will say the reason: VirusTotal
Then you can see the detection from file. VirusTotal The file is actually malware and detected by Kaspersky in link analysis. But Kaspersky didn't detected this cheat as malware in file analysis. That doesn't mean it's malware. Stop Kaspersky-centred thinking, ClamAV is great product and liberated product because it's open source. Which helps you why it's flagged as malware. Second if ClamAV didn't detect then use my product: Releases · HydraDragonAntivirus/HydraDragonAntivirus If still not yet detected then use filescan.io or look community comments like Thor. You can also use Hybrid-Analysis, tria.ge etc. Open source antiviruses calls why it's malware with proof. Closed source ones didn't show his signatures because they are closed source. But you can still guess why it's flagged.
Win.Malware.Zusy-10032984-0;Engine:81-255,Target:1;0&1&2&3&4;687474703a2f2f39352e3231342e32342e3131372f737663686f7374322e657865;4661696c656420746f206765742070726f63657373204944;5c737663686f73742e657865;6170692d6d732d77696e2d636f72652d72656769737472792d6c312d312d302e646c6c::w;4552524f523a20496d4775695f496d706c4f70656e474c335f4372656174654465766963654f626a656374733a206661696c656420746f20636f6d70696c6520257321205769746820474c534c3a202573
Ask ChatGPT then. It will say the reason: VirusTotal
Then you can see the detection from file. VirusTotal The file is actually malware and detected by Kaspersky in link analysis. But Kaspersky didn't detected this cheat as malware in file analysis. That doesn't mean it's malware. Stop Kaspersky-centred thinking, ClamAV is great product and liberated product because it's open source. Which helps you why it's flagged as malware. Second if ClamAV didn't detect then use my product: Releases · HydraDragonAntivirus/HydraDragonAntivirus If still not yet detected then use filescan.io or look community comments like Thor. You can also use Hybrid-Analysis, tria.ge etc. Open source antiviruses calls why it's malware with proof. Closed source ones didn't show his signatures because they are closed source. But you can still guess why it's flagged.
You've provided a comprehensive approach to malware detection. Using multiple tools such as ClamAV, VirusTotal, and HydraDragonAntivirus can indeed increase the chances of identifying malware. Open source antiviruses are beneficial as they allow users to understand the detection process. However, closed source antiviruses can also be effective, even if their detection methods are not openly disclosed.
ok Bitdefender detected for ATC and now for signatures :3
Trojan.Agent.GLUC
Trojan.Agent.GLUC
ok Bitdefender detected for ATC and now for signatures :3
Trojan.Agent.GLUC
3/4 days after my submission, like Avast...
Signatures on this file are useless. Attackers repack it frequently. Only behavioural detections would work.
Even Deep Learning Models are trending down. Too easy to evade/fool.
Even Analysts can be fooled. This is one of my favs that I posted. This one is a MS Threat Analyst
Malware Analysis - Evasive Sample - Bypassed MS
Signed sample pretending to be TeamViewer. It is a password stealer. As a DFIR Specialist it's easy to me. After submitting the sample to Microsoft... They said the file was clean. File has been in the wild for a week now. Welcome to the current state of insecurity. Happy hunting! VirusTotal
malwaretips.com
Xcitium Analyst Fooled
Malware Analysis - Malware/PUA listed as clean (again)
Found this at a customer. It was blocked but upon further inspection I saw that Xcitium marks the files as clean. Their human analyst also concluded its clean. ITS NOT. https://verdict.xcitium.com/get_info?sha1=caaa052ae05d6032d8361e61fa22a686c6b5a392...
malwaretips.com
Last edited:
That’s not from now. Deep Learning in the form of static analysis has always suffered with packers, because the only feature it can extract is that the file is packed. In some cases, this will be enough trigger detection. With the electron packages, it is not. They are very variable.
This kind of malware is better handled by reputation and behaviour.
There is no simple method is that is best and bulletproof, rather an ensemble of methods works together to provide what’s best for the case.
Signatures most of the time are useless. There are many groups abusing the electron package to distribute stealers and they push new variants daily.
Agreed. Static analysis for binaries is tricky for ML models. I do see how electron apps can be a bad match up for a well trained model.
Bitdefender signature comes late, but on my test it identified at least 3 variants of this malware.
Closed-source and open source AVs are both prone to false positives. A system with more users and more channels for receiving safe files will be less susceptible, but far from perfect. During the development, all technologies are created with false positives reduction/elimination in mind.
Evidence of the detection most of the time is not necessary, users would open a case with the vendor and they will investigate the detection method.
Providing evidence why and how the file is detected will allow attackers to evade this detection.
The main culprit of this malware is this obfuscated js file which ESET detects:
Though a vendor like ESET who are extremely good at creating very smart behavioral signatures that might be able to detect some new future variants, the best defense against these stealers is behavior blocking as @Trident suggested. So, the likes of Bitdefender and Kaspersky are likely to spend less time creating signatures and more time on training their behavior blocker on new tactics.
In your opinion, what is the best antivirus with behavioral detection?
For home users Kaspersky, Bitdefender and ZoneAlarm, followed by Avast and Norton. You won’t go wrong with any of them.
- Status
You may also like...
-
-
Self-Made Fortran Malware Analysis- Started by HydraDragonAntivirus
- Replies: 140
-
