Serious Discussion Kaspersky misses a fake crack tool

[Xciting]

So a launched a fake crack and voodoosheild blocked it and gave 100% AI while... kaspersky uhhhh.. doesnt even react to it like at all even on VT theres no detection .... the guy even has a yt.... VT: VirusTotal

 

[Xciting]

Blocked by elastic:

The reason i use elastic is if kaspersky misses something elastic will most of the time block the missed malware :>

And yes my kaspserky is enabled and at optimal settings.

 

[nickstar1]

Does this fake crack perform any malicious functions to the system or personal info? If not i wouldn't really care much if it passed kaspersky its just a junk download.

 

[ForgottenSeer 93786]

Looking at the names of the detections (Hacktool/Patcher), it doesn't seem to be actually malicious, just a "legitimate" crack.

 

[harlan4096]

Exactly, Kaspersky does not add cracks using the same criteria as other avs firms, if the crack does not perform any malicious activity in the system, They won't add...

 

[Neutrophil]

Exactly, Kaspersky does not add cracks using the same criteria as other avs firms, if the crack does not perform any malicious activity in the system, They won't add...

this is why kaspersky is popular among the pirates too. you get good security without having to worry about the crack getting quarantined or deleted.

 

[Betonf]

Blocked by elastic: View attachment 277399The reason i use elastic is if kaspersky misses something elastic will most of the time block the missed malware :>

And yes my kaspserky is enabled and at optimal settings.

Elastic Security?!

 

[Shadowra]

I think that if the crack/keygen doesn't perform malicious actions, Kaspersky won't detect it.

this is why kaspersky is popular among the pirates too. you get good security without having to worry about the crack getting quarantined or deleted.

Kaspersky is very responsive if a hacker tries to crack the product
Many hacked keys are quickly blacklisted, and tools for forcing Trial Resets or injecting force licenses are blocked by Kaspersky

 

[Nightwalker]

Did the file actually executed (doesnt seem to be the case)? Hard to say that Kaspersky failed without knowing if the System Watcher module (behavior blocker) could have blocked it if the crack tried to do something malicious.

Anyway, I dont see the point of this thread at all ...

 

[Trident]

Anyway, I dont see the point of this thread at all ...

+1
The file is classified as PUP because vendors believe this is the ethical way. It is up to the vendor’s discretion to decide if detections will be added for PUPs and does the file fit their criteria for this category.

 

[codswollip]

It's fake. Kaspersky did its job. No FP. #win

The better question is why VS alerted. Probably cuz it was new (check the FP box, and continue).

this is why kaspersky is popular among the pirates

You have data for that - or is that a personal confession ?

 

[KevinYu0504]

This file, which Kaspersky seems to have analyzed,
And judged safe, which is why the VT scan results show safe.

Kaspersky Threat Intelligence Portal :

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

If you think a file may be harmful and Kaspersky is wrong,
You can contact their customer service for confirmation.

 

[Neutrophil]

It's fake. Kaspersky did its job. No FP. #win

The better question is why VS alerted. Probably cuz it was new (check the FP box, and continue).


You have data for that - or is that a personal confession ?

popular among people i know who pirate.. being a broke college student back in the day it aint hard to become a pirate . but i don't do it anymore. it just defeats the whole point of security.

 

[Ink]

Does CyberLock’s VAi pop-up provide any additional information as to why it is deemed unsafe?

From the screenshot provided, all I see is the file is not digitally signed. What other parameters does the AI use to determine a files risk status?

If there is no malicious behaviour, then some AV companies consider Warez (Cracks, Keygens) as PUA.

 

[danb]

Does CyberLock’s VAi pop-up provide any additional information as to why it is deemed unsafe?

From the screenshot provided, all I see is the file is not digitally signed. What other parameters does the AI use to determine a files risk status?

If there is no malicious behaviour, then some AV companies consider Warez (Cracks, Keygens) as PUA.

No, ML/Ai engines are signatureless and perform binary classification, so only a Safe or Unsafe verdict is rendered. Sure, you could try to analyze all 400+ features and try to figure out why the Ai engine determined a certain file to be Safe or Unsafe, but that would be a fool’s errand.

The entire point of CyberLock is to find and allow only Safe files, and block everything else, and I can assure you this file should never be considered Safe.

Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for '(x64bit.)_4.2.x.x_patch.exe'

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

http://voodooshield.ddns.net:8080/analysis/2030/

Is it malicious? Maybe, maybe not. But it certainly is not Safe.

 

[roger_m]

Is it malicious? Maybe, maybe not. But it certainly is not Safe.

If it's not malicious - and I highly doubt it is, why would it not be safe? I consider that it's most likely not malicious, because Kaspersky says it's not and several other antiviruses just detect it as a crack, rather than actual malware.

 

[danb]

This file is not Safe / Clean, all you need to do is look at the sandbox reports.

Or you can look it up on Kaspersky's Threat Intelligence Portal.

Even Kaspersky does not classify the file as Clean...

This is how it looks when Kaspersky classifies a file as Clean / Safe (Supremo.exe)...

 

[harlan4096]

Not Categorized in KOTIP may mean: file is still not known by KSN, K. whitelisting, etc. and/or They just did not add that file as Clean, but that does not man it is malicious, in my humble opinion

 

[danb]

Not Categorized in KOTIP may mean: file is still not known by KSN, K. whitelisting, etc. and/or They just did not add that file as Clean, but that does not man it is malicious, in my humble opinion

I am certainly not dissing Kaspersky, but keep in mind, 6 days ago the file was detected as Clean, and now it is detected as "Not categorized". In my opinion, "Not categorized" is a much better determination than "Clean" for this file. It will be interesting if the verdict changes in the future.

Discussion Thread - Kaspersky misses a fake crack tool

So a launched a fake crack and voodoosheild blocked it and gave 100% AI while... kaspersky uhhhh.. doesnt even react to it like at all even on VT theres no detection .... the guy even has a yt.... VT: VirusTotal

malwaretips.com

 

[harlan4096]

I sent personally the file to K. analysts, and got a “Not malicious” verdict...