App Review AVG vs Symantec Antivirus: This One Cleaned Better

[Khushal]

Content source

https://youtu.be/UXxCikwej8Q

AVG vs Symantec Antivirus: This One Cleaned Better​

 

[Parkinsond]

Symantec is the winner?
As usual, no clear view of the final block rate in CMD window.

 

[Pat MacKnife]

Symantec found a few more malwares than AVg , but AVG is much more lite. . . almost same protection.

 

[Parkinsond]

Symantec found a few more malwares than AVg , but AVG is much more lite. . . almost same protection.

Impressive detection by Symantec; the last time was tested, missed several JS samples.

 

[Parkinsond]

A malicious code of classic clickfix attack, copied and pasted into notepad, saved as cmd file, checked by VT: only Symantec could detect.

VirusTotal

VirusTotal

www.virustotal.com

 

[Parkinsond]

A malicious code of classic clickfix attack, copied and pasted into notepad, saved as cmd file, checked by VT: only Symantec could detect.

VirusTotal

VirusTotal

www.virustotal.com

View attachment 295197

Detected by K dynamic analysis

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[Parkinsond]

A malicious code of classic clickfix attack, copied and pasted into notepad, saved as cmd file, checked by VT: only Symantec could detect.

VirusTotal

VirusTotal

www.virustotal.com

View attachment 295197

K added it to its signatures later

 

[Khushal]

K added it to its signatures later

View attachment 295207

No .a at end so no signature just uds detection.

 

[Parkinsond]

No .a at end so no signature just uds detection.

What uds stands for?
Is not VT is signature-based? Which explains why it was not detected by K on VT, meanwhile it was detected by K on KTIP.

 

[Khushal]

What uds stands for?
Is not VT is signature-based? Which explains why it was not detected by K on VT, meanwhile it was detected by K on KTIP.

https://media.kaspersky.com/en/business-security/enterprise/Kaspersky_Security_Intelligence_Services_Threat_Intelligence_Services.pdf#:~:text=Malware%20Hashes%20(UDS)%20%E2%80%93%20a%20set%20of,Detection%20System)%20based%20on%20a%20file's%20metadata

Malware Hashes (UDS) - a set of file hashes detected by Kaspersky Lab cloud technologies (UDS stands for Urgent Detection System) based on a file's metadata and statistics (without having the object itself). This enables the identification of new and emerging (zero-day) malicious objects that are not detected by other methods.

 

[Parkinsond]

Malware Hashes (UDS)

Is not hashes part of signature detection?

If not signature, how can explain absence of detection on VT by K, while it was detected on KTIP by dynamic analysis?

 

[Khushal]

Is not hashes part of signature detection?

If not signature, how can explain absence of detection on VT by K, while it was detected on KTIP by dynamic analysis?

dynamic analysis environment in vt and opentip might not be same. KOTIP dynamic analysis min. takes 3 minutes

 

[Parkinsond]

dynamic analysis environment in vt and opentip might not be same. KOTIP dynamic analysis min. takes 3 minutes

Symantec detection on VT was heuristic detection (just as the one of K which appeared later on); Symantec detection on VT appeared long before VT behavioral analysis finishes which by the way detected nothing.

 

[Parkinsond]

Currently, Symantec removed its detection, while QuickHeal is detecting it

 

[SeriousHoax]

A malicious code of classic clickfix attack, copied and pasted into notepad, saved as cmd file, checked by VT: only Symantec could detect.

VirusTotal

VirusTotal

www.virustotal.com

View attachment 295197

It is likely to be detected by the likes of Bitdefender at runtime, ESET via memory scan, etc.

 

[Sorrento]

They are much of a sameness really from the original video, swings & roundabouts I reckon.

 

[Parkinsond]

It is likely to be detected by the likes of Bitdefender at runtime, ESET via memory scan, etc.

If I have VM, I would try running it to find out if MD can detect post-execution.

 

[SeriousHoax]

If I have VM, I would try running it to find out if MD can detect post-execution.

I'll try checking later at night but by that time MD would probably create a signature.

 

[Parkinsond]

I'll try checking later at night but by that time MD would probably create a signature.

I will follow the its VT timeline to see if things are going to change again.

 

[Captain Awesome]

A malicious code of classic clickfix attack, copied and pasted into notepad, saved as cmd file, checked by VT: only Symantec could detect.

VirusTotal

VirusTotal

www.virustotal.com

View attachment 295197

Can you please DM the sample?