i understand what youre saying but its hard to agree as the sample has this from others vendors: VirusTotalYes and No. CIS did not encounter the full sample (initial sample + payload) but only the "currently unharmful" part of it (no payload).
Most AVs would detect such a sample as not harmful as I presented in my previous post (sample with changed URL to non-existent payload):
https://malwaretips.com/threads/com...one-malware-not-contained.134116/post-1111332
You are wrong. The increasing number of detections is caused by borrowing detections from other AVs. Look at the detections in my previous post. The submitted sample is as malicious as your sample (no difference for AVs).
AVs do not fail while allowing silent connections to unknown servers. In this way, most AVs would also fail as can be seen in the detection example from my previous post.
Yes, the sample should be detected as a trojan when full information about its history is known. CIS failed in some way, just as most AVs would fail in similar situations.
It is your video. I would keep the sample and use it to show that such incomplete samples can be problematic in tests (for any AV). With such samples, the AV detection result can depend on the moment when the sample was analyzed and not entirely on the AV capabilities.
Edit.
Still, I do not fully understand why Xcitium can detect by signature the sample with a modified URL, but your sample (which behaves in the same way) was considered Trusted by the Comodo analyst. It is possible that initially, Comodo could detect your sample as malicious too, and that detection would change to Trusted after Valkyrie analysis.
for now its 45/72. its a big "wrong detection" by many names. my argument just gains force. if its an file that download something bad but its not downloading anything anymore, thus cis do not detect it, so why not detect the connection try out? the file is there. you say that its a file that tries to download something from some remote server, but can you provide the ip for it? or where did you get this information?
anyways, even if its right, what youre saying, still, cis should block it or atleast show some alert as the file is supose to try to connect to an unknow ip.
edit.: just for clarification. the test is to show a problem. a file that is a malware and cis do not block nor detect it. as in every video showing this kind of thing with cis. and to have a point i show the results from virustotal and valkyrie itself. it really doesnt matter that much what kind of malware it is or if the server is down or not. what matters the most for users is that cis (and others) fail to prevent execution of an malware classified by many as a trojan. and thats the point. but its nice to hear yous explanations as i learn many good things and learn somethings not so good about many.
