Advice Request Engines on VirusTotal, worse version?

[ShenguiTurmi]

I just got a new backdoor sample from someone and it will inject a lot of (random?) processes and start payloads, and I found that DeepInstinct detected it when I tested it.

Spoiler: DI

Then I uploaded it to VT to see if other security software had detected it, and that's when a very strange scene occurred.

Spoiler: VT

As shown in the image, DeepInstinct on VirusTotal does not detect it.
I initially thought that it was the very high threshold of ML's confidence on VT, which I set to a medium threshold, that produced the result, but I observed that it was not so simple.

Spoiler: DI Portal

Yes, in DeepInstinct's backend I found that the machine learning gives a very high degree of confidence, meaning that the sample should be detected at any setting. This is very strange, and the only reason is that VT and I do not have the same ML engine or model.
I asked other friends who follow security and I was told that TrendMicro often has different results than VirusTotal when they test as well.
I understand that there may be some different results on VirusTotal due to limitations, such as Avira and Gridinsoft dont have cloud. But I was very surprised that even the basic ML results were different.

Have you guys noticed such phenomenon? Or is this just an isolated case that I am experiencing?
It may be inappropriate to post virus samples in the public section, so I'll just include the link to VT: VirusTotal

 

[Kongo]

I just got a new backdoor sample from someone and it will inject a lot of (random?) processes and start payloads, and I found that DeepInstinct detected it when I tested it.

Spoiler: DI

View attachment 274460

Then I uploaded it to VT to see if other security software had detected it, and that's when a very strange scene occurred.

Spoiler: VT

View attachment 274461

As shown in the image, DeepInstinct on VirusTotal does not detect it.
I initially thought that it was the very high threshold of ML's confidence on VT, which I set to a medium threshold, that produced the result, but I observed that it was not so simple.

Spoiler: DI Portal

View attachment 274462

Yes, in DeepInstinct's backend I found that the machine learning gives a very high degree of confidence, meaning that the sample should be detected at any setting. This is very strange, and the only reason is that VT and I do not have the same ML engine or model.
I asked other friends who follow security and I was told that TrendMicro often has different results than VirusTotal when they test as well.
I understand that there may be some different results on VirusTotal due to limitations, such as Avira and Gridinsoft dont have cloud. But I was very surprised that even the basic ML results were different.

Have you guys noticed such phenomenon? Or is this just an isolated case that I am experiencing?
It may be inappropriate to post virus samples in the public section, so I'll just include the link to VT: VirusTotal

Did DeepInstinct detect it pre or post execution? In your screenshot it says that the Deep Static Analysis detected the sample. Normally the static detection of the product, should also be available on VirusTotal, but if the detection was dynamic and after execution, then it's normal that VirusTotal doesn't catch it.

 

[struppigel]

From what I read on their website, DeepInstinct is solely based on static analysis.You are right that in this case the expectation would be that VT results are the same.

Here are a number of reason I can think of, why the result still differs, but all of these are speculation!

• Updates of the AI model can arrive later on VT than on endpoints, so yours might just be more up-to-date
• DeepInstinct might also include contextual data, e.g., where the file was downloaded from, or if it was downloaded at all, where it is currently on the filesystem, etc. That data will not be there or will be different on VT
• The settings might be different on VT. You said the confidence indicates that all settings should have detected this threat, but who knows what else those settings entail. It can be more complex than just confidence level adjustment

If you are really curious, ask DeepInstinct support.

 

[harlan4096]

This is not new, and also happens with other products, confirmed here with Kaspersky, and others security products I've been testing in Malware Hub of the forum, so VT results/detections must be taken with "a sack of salt"

 

[ShenguiTurmi]

Did DeepInstinct detect it pre or post execution? In your screenshot it says that the Deep Static Analysis detected the sample. Normally the static detection of the product, should also be available on VirusTotal, but if the detection was dynamic and after execution, then it's normal that VirusTotal doesn't catch it.

pre execution.
That's why I'm confused......

 

[Jonny Quest]

Same with the Bitdefender installer downloaded from the Central Account, which was flagged about two weeks ago by Zillya as malicious.

 

[Shadowra]

I have already seen this with Eset

 

[[correlate]]

Yes, I noticed that before, so I don't rely on scanning files in one location
Rather, he used several sites
of between it
virustotal
intezer
filescan

 

[Bot]

I just got a new backdoor sample from someone and it will inject a lot of (random?) processes and start payloads, and I found that DeepInstinct detected it when I tested it.

Spoiler: DI

View attachment 274460

Then I uploaded it to VT to see if other security software had detected it, and that's when a very strange scene occurred.

Spoiler: VT

View attachment 274461

As shown in the image, DeepInstinct on VirusTotal does not detect it.
I initially thought that it was the very high threshold of ML's confidence on VT, which I set to a medium threshold, that produced the result, but I observed that it was not so simple.

Spoiler: DI Portal

View attachment 274462

Yes, in DeepInstinct's backend I found that the machine learning gives a very high degree of confidence, meaning that the sample should be detected at any setting. This is very strange, and the only reason is that VT and I do not have the same ML engine or model.
I asked other friends who follow security and I was told that TrendMicro often has different results than VirusTotal when they test as well.
I understand that there may be some different results on VirusTotal due to limitations, such as Avira and Gridinsoft dont have cloud. But I was very surprised that even the basic ML results were different.

Have you guys noticed such phenomenon? Or is this just an isolated case that I am experiencing?
It may be inappropriate to post virus samples in the public section, so I'll just include the link to VT: VirusTotal

It's not uncommon for different security vendors to have different detection rates when it comes to virus and malware samples. This is because each vendor has their own unique set of ML models, heuristics, and algorithms that they use to analyze and detect threats. In addition, not all vendors have access to the same data sources or intelligence feeds, which can also impact detection rates.

Furthermore, it's important to note that VirusTotal is just a tool that aggregates results from various security vendors, and as such can only provide a snapshot of the detection capabilities of those vendors at a specific point in time. It's possible that detection rates for a particular sample may change over time as vendors update their ML models and heuristics.

In your specific case, it's hard to say for certain why DeepInstinct and VirusTotal had different results for that backdoor sample. That being said, it's not uncommon for ML models to have different detection rates depending on the data they are trained on, the features they use, and the algorithms they employ. So it's entirely possible that DeepInstinct and VirusTotal simply have different ML models that are more or less effective at detecting that particular sample.