Make your video test requests!

vonvon

Level 3
Verified
Well-known
Nov 25, 2014
121
As a curiosity, if you have time, it might be interesting to test the first African antimalware: MEYE antivirus.
 
  • +Reputation
  • Like
Reactions: Nevi and Shadowra
F

ForgottenSeer 109138

How about an individual module test.

Webroot

I would like to see when you have time, the journal and rollback system put through the hoops. A folder of ransomware should do the trick nicely. It does state the journal and rollback feature would need plenty of disk space so hopefully you can accommodate this via your VM's allocation.
 
  • Like
Reactions: Nevi

danb

From VoodooShield
Verified
Top Poster
Developer
Well-known
May 31, 2017
1,742
Hey @Shadowra, in response to the post below, please test 10 true zero-days against VT and CL (WLC / VoodooAi).


Anyone who knows anything about cybersecurity already knows who is going to win ;).
 
F

ForgottenSeer 109138

Hey @Shadowra, in response to the post below, please test 10 true zero-days against VT and CL (WLC / VoodooAi).


Anyone who knows anything about cybersecurity already knows who is going to win ;).
What happens if he treats it like an average users test as he does others, and as a average user, the user wants to run that application they clicked on, so they click "allow" on the pop up, or as some say around this forum, accidents happen and allow could be accidentally clicked.
 

danb

From VoodooShield
Verified
Top Poster
Developer
Well-known
May 31, 2017
1,742
What happens if he treats it like an average users test as he does others, and as a average user, the user wants to run that application they clicked on, so they click "allow" on the pop up, or as some say around this forum, accidents happen and allow could be accidentally clicked.
Sure, accidents happen, but at least the user has a second chance of blocking malware, as opposed to the malware automatically executing. I mean really, the alternative is that the malware is automatically allowed. See what I mean?

Having said that, I think most users will not allow an item they are unsure of if there is a big red prompt telling them that it is not safe, and an extra confirmation prompt letting the user know that they may be introducing malware if they click Allow.
 
F

ForgottenSeer 109138

Sure, accidents happen, but at least the user has a second chance of blocking malware, as opposed to the malware automatically executing. I mean really, the alternative is that the malware is automatically allowed. See what I mean?

Having said that, I think most users will not allow an item they are unsure of if there is a big red prompt telling them that it is not safe, and an extra confirmation prompt letting the user know that they may be introducing malware if they click Allow.
I was curious, as I have seen users go so far as disabling components to allow an application being blocked by their security in this forum.
 
F

ForgottenSeer 109138

A user who wants to install malware despite all warnings will succeed. No security software can help.
If a user "whitelist" the malware, nothing will certainly help in a anti exe, although other modules in a full suite might stop it if a user ignores a prompt or clicks proceeded. Like the user I was referring to getting frustrated trying to figure out what to disable in Kaspersky to allow it through, he kept disabling things but the suite kept stopping it.
 
  • Like
Reactions: Trident and rashmi

Trident

Level 34
Verified
Top Poster
Well-known
Feb 7, 2023
2,349
@Shadowra

Can you test Sophos Home?
Let’s see Sophos home, I am seeing some interesting, very generic detections, for example they seem to be really aggressive now towards obfuscated scripts… will be an interesting one.

In April, they also removed all customisations from the home software and aligned it completely with the business one, so now more frequent updates will be delivered. Before it was getting 2-3 updates a year.
In May, they added Game Mode finally.
 

Trident

Level 34
Verified
Top Poster
Well-known
Feb 7, 2023
2,349
DevSecure vs Chomar (C-Prot) vs Xylent would be interesting to see which AV is best Turkish antivirus.
Is this yours?

If it is, I suggest you withdraw the test request for now… first develop some AI and ML models, heuristics, generic detections, behavioural blocking and others… 😳🫣
Your AV only has one Yara rule to identify malware you created for testing purposes and Eicar test file. And it’s got 16.9MB database full of malware hashes…

It looks more like a uni project…
 
Last edited:

XylentAntivirus

Level 3
May 9, 2024
101
Is this yours?

If it is, I suggest you withdraw the test request for now… first develop some AI and ML models, heuristics, generic detections, behavioural blocking and others… 😳🫣
Your AV only has one Yara rule to identify malware you created for testing purposes and Eicar test file. And it’s got 16.9MB database full of malware hashes…

It looks more like a uni project…
Machine Learning module exits in sourceforge I just forked that project on sourceforge and developed this. Now it's 1.4gb even if I removed duplicates and some very old hashes.
 
  • Applause
Reactions: Shadowra

Shadowra

Level 37
Thread author
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,630

I've just tested it quickly, even though you haven't updated it yet and, for the moment, too many things need to be revised...

For the record, Xylent is an antivirus project based on ClamAV. It also uses MD5 and SHA1 rules from MalShare, VirusShare, VirusSign etc., as well as YARA.
The file is 1.4GB in size, installs and... doesn't launch... I launch it directly in admin. (xylent_antivirus.exe & engine.exe )

The product consumes a lot of Ram... Between 2GB and 5GB of RAM! That's huge!!!
Capture d'écran 2024-05-09 213533.pngCapture d'écran 2024-05-09 213643.png

Xylent create no registry key at startup. In case of infection, the antivirus will not protect you. Why is this? Because there's no entry at startup... a shame for an AV...

Capture d'écran 2024-05-09 214622.png

Xylent tries to create YARA rules with Powershell. Only errors...

Capture d'écran 2024-05-09 214957.png

Obviously, with so much RAM monopolized by Xylent, the VM crashed. Either the AMD graphics driver crashed, or... BSOD (I had both)
There's definitely a problem with the anti-virus and an optimization problem.
For the moment, I won't test it. To be reworked!
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top