Malware Hub Report Ikarus AV - May 2020 Report

[harlan4096]

Ikarus AV - May 2020 Report

Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.

__

C: Clean / P: Protected / P - NC: Protected - Not Clean / I: Infected / E: Encrypted

* Dynamic BB Bonus Test (Resident Protection Disabled)
* Partially Blocked
* BSR: Before System Reboot
* ASR: After System Reboot

May 2020	Samples Pack	Static Detection	Dynamic Detection	Total Detection	System Files Encrypted	2nd Opinion Scanners	System Final Status	Thread Link
26/04/2020​	1​	0 / 1​	1 / 1​	1 / 1​	No​	C: WV HMP I: NPE​	P - NC​	Post#3​
28/04/2020​	15​	7 / 15​	0 / 8​	7 / 15​	No​	I​	I​	Post#4​
30/04/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C​	P​	Post#3​
01/05/2020​	2​	0 / 2​	2 / 2​	2 / 2​	No​	C​	C​	Post#2​
02/05/2020​	2​	2 / 2​	N/A*​	2 / 2​	No​	C​	C​	Post#3​
03/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C: HMP I: WV NPE​	BSR: I ASR: I​	Post#2​
04/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	Yes​	C​	E​	Post#2​
06/05/2020​	2​	0 / 2​	0 / 2​	0 / 2​	No​	C​	P​	Post#2​
08/05/2020​	2​	0 / 2​	1* / 2​	1* / 2​	No​	I​	BSR: I ASR: I​	Post#2​
09/05/2020​	3​	3 / 3​	N/A*​	3 / 3​	No​	C​	C​	Post#2​
11/05/2020​	2​	2 / 2​	N/A*​	2 / 2​	No​	C​	C​	Post#2​
11/05/2020​	9​	5 / 9​	0 / 4​	5 / 9​	Yes​	C​	E​	Post#2​
12/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C​	C​	Post#3​
13/05/2020​	2​	0 / 2​	1 / 2​	1 / 2​	Yes​	C​	I + E​	Post#2​
13/05/2020​	2​	0 / 2​	0 / 2​	0 / 2​	No​	C​	P​	Post#3​
15/05/2020​	3​	2 / 3​	0 / 1​	2 / 3​	No​	C: WV I: HMP NPE​	I​	Post#4​
16/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	Yes​	C: WV HMP I: NPE​	I + E​	Post#3​
18/05/2020​	18​	14 / 18​	0 / 4​	14 / 18​	No​	C: NPE I: WV HMP​	BSR: I ASR: P - NC​	Post#3​
19/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	I​	BSR: I ASR: I​	Post#2​
19/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C: WV I: HMP NP​	BSR: I ASR: I​	Post#5​
21/05/2020​	13​	8 / 13​	1 / 5​	9 / 13​	No​	C​	BSR: I ASR: P​	Post#4​
23/05/2020​	2​	2 / 2​	N/A*​	2 / 2​	No​	C​	C​	Post#4​
24/05/2020​	2​	2 / 2​	N/A*​	2 / 2​	No​	N/A​	C​	Post#2​
25/05/2020​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C​	P - NC​	Post#2​
25/05/2020​	17​	9 / 17​	1* / 8​	9 + 1* / 17​	No​	I​	I​	Post#3​
/05/2020​	​	/​	/​	/​	No Yes​	C I​	P C I​	Post#​

 

[harlan4096]

I would like to thank user @Paul.R who kindly suggested me to test Ikarus AV and managed to get me a trial license, thanks

 

[upnorth]

I know I know, one shouldn't judge a book by it's cover , but can you please share a few pics on it's UI ( user interface ) for those that haven't seen it?

Btw, was the license for 30 days?

 

[roger_m]

I know I know, one shouldn't judge a book by it's cover , but can you please share a few pics on it's UI ( user interface ) for those that haven't seen it?

There are some screenshots at Softpedia.

https://www.softpedia.com/get/Antivirus/Ikarus-Virus-Utilities.shtml

 

[harlan4096]

Here You are:

Spoiler

5.62 MB file on MEGA

mega.nz

This is a very basic AV, it seems no WebAV filter and no settings to tweak main protection FileAV module nor Behahviour Blocker...

 

[stefanos]

Here You are:

Spoiler

View attachment 238203View attachment 238204

5.62 MB file on MEGA

mega.nz

Uglyyyyyyy .......

 

[stefanos]

Thanks for another good test from you @harlan4096

 

[WiseVector]

The file in https://malwaretips.com/threads/terdot-a-26-04-2020.100374/post-876570 is not malware. Thanks @harlan4096 for the sample.
It a just corrupt PE file.

 

[harlan4096]

Yes! I sent also that dll detected by NPE to Kaspersky and got the same verdict, not malicious corrupted file.

 

[upnorth]

The file in https://malwaretips.com/threads/terdot-a-26-04-2020.100374/post-876570 is not malware. Thanks @harlan4096 for the sample.
It a just corrupt PE file.

Please help and clarify. What file exactly are you talking about?

 

[WiseVector]

Please help and clarify. What file exactly are you talking about?

The file "byskiez.dll" detected by NPE is not malware, it is corrupted. The xls file is indeed malware.

 

[upnorth]

You got me nervous and thought you even meant the xls.

Thanks for the help. Much appreciated.

 

[show-Zi]

Here You are:

Spoiler

View attachment 238203View attachment 238204

5.62 MB file on MEGA

mega.nz

This is a very basic AV, it seems no WebAV filter and no settings to tweak main protection FileAV module nor Behahviour Blocker...

Should be supplied with emisi's Behahviour-Blocker

 

[upnorth]

Last day today if I recall the license period correct.

Very interesting test and I must say, Ikarus is very strong and early with it's signatures. That is also it's weakness, because the home user version sadly don't seem to have much more in it's toolbox. Maybe their Enterprise version works better.

Thanks @harlan4096 for the great work!