Self-Made Fortran Malware Analysis

[harlan4096]

Yes, it was 1st upload to OPENTIP, since the analysis took very long, field Fist Seen, some hours ago was showing 13:43 or so, when I just upload it, some minutes later this thread was created.

 

[bazang]

View attachment 286847
Detected by VirusScope as Generic.Trojan.C@1@1

That is great. You will not find anybody coming to this thread and praising Comodo. I would not be surprised if the response was "The detection by Comodo is a bug. Not a feature."

 

[Pat MacKnife]

Pretty sure Panda will catch it

 

[Vitali Ortzi]

Yes, it was, since the analysis took very long, field Fist Seen, some hours ago was showing 13:43 or so, when I just upload it, some minutes later this thread was created.

Analysis taking too long system infected is at least partially failed if not failed at the ksn part and total results was partial damage to the machine , lost of some settings ,files

 

[Vitali Ortzi]

That is great. You will not find anybody coming to this thread and praising Comodo. I would not be surprised if the response was "The detection by Comodo is a bug. Not a feature."

Only people who use comodo like me will praise it when it somehow works at detection XD

But at prevention it can stop most malware (that's why I use it )

 

[bazang]

Not just that new gaming engine languages and even rust to some extent

With the rise of AI, threat actors can use those to build the base code, and their job is to debug. They can use any language. Using this method is not new. It has been used for a long time. The difference now is the convenience of rapid build using AI.

 

[harlan4096]

I'm talking about 2 different executions, 1st one was to KOPENTIP, that caught it after 1st analysis, once uploaded was tagged as unknown just the analysis ended -> Malware, and second execution in my VM with KPremium, with the already mentioned results.

 

[bazang]

Only people who use comodo like me will praise it when it somehow works at detection XD

But at prevention it can stop most malware (that's why I use it )

I don't want to derail this thread, but that is Melih's point:

"My personal agenda against the big name antivirus has produced a hot buggy mess of a security software, and yet, still it does just as good of a job, if not better, than all those big name antivirus. All at $0 cost to the consumer."

 

[Vitali Ortzi]

With the rise of AI, threat actors can use those to build the base code, and their job is to debug. They can use any language. Using this method is not new. It has been used for a long time. The difference now is the convenience of rapid build using AI.

You can nowadays code undetected malware without even knowing to code
Pretty scary and you can tell ai to port it into all kinds of languages and you will just need to tell ai to use the least popular languages

 

[CyberDevil]

Here comes the detection! Not as fast as Kaspersky, but still pretty good.

It hasn't come to VT yet.

 

[Vitali Ortzi]

Here comes the detection! Not as fast as Kaspersky, but still pretty good.
View attachment 286866

It hasn't come to VT yet.

Change the hahs and try again
(Open the exe in notepad and add something in the end of the file )

 

[Vitali Ortzi]

Here comes the detection! Not as fast as Kaspersky, but still pretty good.
View attachment 286866

It hasn't come to VT yet.

Blocked too in checkpoint but when I change the hash it bypassed it again

Try changing the hash and be amazed by it being undetected again XD

 

[Vitali Ortzi]

Blocked too in checkpoint but when I change the hash it bypassed it again View attachment 286867

Try changing the hash and be amazed by it being undetected again XD

Changing the hash and it's clean again

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

https://tip.neiki.dev/file/9b1c7c8a98b5e472e735b9883f6095a6bffe90497743b5142795647530239fa8

Comodo didn't detect it too (sent to human analysis so it might get detected by the time you're reading this)

Cloud Verdict Customer Login | Xcitium Cloud Verdict

Sign in to your Comodo Valkyrie account to access your account and use the File analysis system. Not registered,Create an account here.

verdict.xcitium.com

 

[Vitali Ortzi]

Yes, it was 1st upload to OPENTIP, since the analysis took very long, field Fist Seen, some hours ago was showing 13:43 or so, when I just upload it, some minutes later this thread was created.

Opentip didn't detect it with a changed hash so if a hash change is enough then it's awful

 

[Nikola Milanovic]

Changing the hash and it's clean again

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

https://tip.neiki.dev/file/9b1c7c8a98b5e472e735b9883f6095a6bffe90497743b5142795647530239fa8

Comodo didn't detect it too (sent to human analysis so it might get detected by the time you're reading this)

Cloud Verdict Customer Login | Xcitium Cloud Verdict

Sign in to your Comodo Valkyrie account to access your account and use the File analysis system. Not registered,Create an account here.

verdict.xcitium.com

View attachment 286868

Its detected by VirusScope(Static and dynamic behavioral analysis)

 

[Nikola Milanovic]

That is great. You will not find anybody coming to this thread and praising Comodo. I would not be surprised if the response was "The detection by Comodo is a bug. Not a feature."

No its not a bug i tested it again and again VirusScope detected it as Generic.Trojan.C@1@1

 

[Vitali Ortzi]

No its not a bug i tested it again and again VirusScope detected it as Generic.Trojan.C@1@1

can you test after changing the hash

 

[Nikola Milanovic]

can you test after changing the hash

you mean the name?

 

[anirbandutta01]

you mean the name?

Open the exe in notepad and add something in the end of the file. After changing the hash then recheck.

 

[Kongo]

Detected by Deep Instinct static AI:

After changing hash it's undetected. Can't do dynamic analysis tho...