Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 905582" data-attributes="member: 32260">I made a quick examination of Kaspersky detection from 29.08.2019 (214 samples) and found 1 missed sample that could cause infection. This is about 8 times greater than for the AV-Comparatives Malware test from September 2019 and March 2020 (12 missed malware per 20805 total samples).(1/214)/(12/20805) ~ 8I skipped some tests with TAM. It seems that the AV-Comparatives Malware tests do not use as fresh samples as Malware Hub.But the AV-Comparatives Real-world tests have comparable fresh samples to MalwareHub:(1/214 )/(8/1837) = 1.1Edit.Please treat these estimations as suggestions only. There are some problems with interpreting the results on MH, because of missed samples that were not counted for infection (3 cases in our case). Usually, they are related to malware that detected the VM environment. But, there can be also a kind of spying malware (no persistence) that injects code to already running Windows processes or malware that hides under Svchost, etc. Such malware usually starts and quickly terminates - it is hard to see it working without detailed analysis via Any.Run or another sandbox analysis.</blockquote>

[QUOTE="Andy Ful, post: 905582, member: 32260"] I made a quick examination of Kaspersky detection from 29.08.2019 (214 samples) and found 1 missed sample that could cause infection. This is about 8 times greater than for the AV-Comparatives Malware test from September 2019 and March 2020 (12 missed malware per 20805 total samples). (1/214)/(12/20805) ~ 8 I skipped some tests with TAM. It seems that the AV-Comparatives Malware tests do not use as fresh samples as Malware Hub. But the AV-Comparatives Real-world tests have comparable fresh samples to MalwareHub: (1/214 )/(8/1837) = 1.1 Edit. Please treat these estimations as suggestions only. There are some problems with interpreting the results on MH, because of missed samples that were not counted for infection (3 cases in our case). Usually, they are related to malware that detected the VM environment. But, there can be also a kind of spying malware (no persistence) that injects code to already running Windows processes or malware that hides under Svchost, etc. Such malware usually starts and quickly terminates - it is hard to see it working without detailed analysis via Any.Run or another sandbox analysis. [/QUOTE]

Verification