Serious Discussion Ratty missed by many top AVs including Bitdefender

[Khushal]

Ratty or Ratufa is a Java based backdoor.

I tested the following vbs sample with many top AVs: VirusTotal


To my suprise most top AVs blocked it except BD VirusTotal


The above two screenshots show indicators of compromise on BD VM.

 

[Bot]

Thanks for sharing this information. It's concerning to see that many top AVs are missing this. Your tests highlight the importance of continuous updates and improvements in AV software to keep up with evolving threats.

 

[Jonny Quest]

A couple of interesting threads you posted @Khushal

Serious Discussion - Unknown Stealer bypasses Bitdefender and steals discord credentials.

malwaretips.com

 

[lokamoka820]

Is this Bitdefender free? If yes, did you test the same sample with BDTS? I thought VirusTotal use the premium products, but after I hovered over Bitdefender and get this popup, I don't know now if they use the premium or the free version.

 

[silversurfer]

@Khushal Here is not the correct place talking about testing malware samples (missed samples nor in general) in forum section: General Security Discussions

The Malware Hub was the correct place in the past, but only allowed for testers we know they are performing correct testing and they are carefully to avoid getting infected...

We had similar topics in the past in section Malware Analysis
Note: beside your testing information, sharing only links from VirusTotal doesn't following the rules: By Staff - Malware Analysis Forum Rules

 

[piquiteco]

Spoiler: Script VBS

 

[Khushal]

A couple of interesting threads you posted @Khushal

Serious Discussion - Unknown Stealer bypasses Bitdefender and steals discord credentials.

malwaretips.com

Yeah i am stress testing top AVs and monitoring different communities for bypasses.
ESET was poor againt LNKs
Kaspersky struggled against Remcos Cmd loader FUD and so on.

 

[Khushal]

Is this Bitdefender free? If yes, did you test the same sample with BDTS? I thought VirusTotal use the premium products, but after I hovered over Bitdefender and get this popup, I don't know now if they use the premium or the free version.

View attachment 288640

I tested with both

 

[Khushal]

@Khushal Here is not the correct place talking about testing malware samples (missed samples nor in general) in forum section: General Security Discussions

The Malware Hub was the correct place in the past, but only allowed for testers we know they are performing correct testing and they are carefully to avoid getting infected...

We had similar topics in the past in section Malware Analysis
Note: beside your testing information, sharing only links from VirusTotal doesn't following the rules: By Staff - Malware Analysis Forum Rules

Okay care will be taken next time
Inconvenience is regretted.