Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1002201" data-attributes="member: 32260">It looks strange, but such unique and old samples are not dangerous in the wild.They were really dangerous several months ago (for most AVs) when they were never-before-seen malware.Although similar samples can be still found on a few websites with malware samples, they are used only in malware tests (not reused in real-life attacks).The tests performed with a delay cannot show the real protection of the AVs. A significant part of the protection is only used to wean the attackers away from reusing the malware samples. Many AVs do it, so the attackers prefer to use new samples, because the older ones are not so efficient. Making a new sample takes a minute, many times quicker than finding the older samples missed by the AV.Currently, it would be interesting to test how AVs can protect against real-life attacks with modified Magniber MSI samples (delivered from compromised websites including archives, documents, scripts, etc.) without using any signatures. </blockquote>

[QUOTE="Andy Ful, post: 1002201, member: 32260"] It looks strange, but such unique and old samples are not dangerous in the wild. They were really dangerous several months ago (for most AVs) when they were [I]never[/I]-[I]before[/I]-[I]seen[/I] malware. Although similar samples can be still found on a few websites with malware samples, they are used only in malware tests (not reused in real-life attacks). The tests performed with a delay cannot show the real protection of the AVs. A significant part of the protection is only used to wean the attackers away from reusing the malware samples. Many AVs do it, so the attackers prefer to use new samples, because the older ones are not so efficient. Making a new sample takes a minute, many times quicker than finding the older samples missed by the AV. [B]Currently, it would be interesting to test how AVs can protect against real-life attacks with modified Magniber MSI samples (delivered from compromised websites including archives, documents, scripts, etc.) without using any signatures. [/B] [/QUOTE]

Verification