Reply to thread

Message

<blockquote data-quote="Khushal" data-source="post: 1123205" data-attributes="member: 110394">agreed obviously giving eset the crown is misleading.As far as kaspersky missing lumma stealer it possibly never didn&#039;t actually happen. First of all the malware supposedly missed in the video is cryptbot and what is interesting about this botnet is that it is VM aware and it checks first of all what processes are running in the system by sending a HTTP request. It then idles if it detects VM or an AV like Kaspersky and basically does nothing and a simple restart will remove all its traces. It would have been interesting to look what application control or intrusion detection control had to say about the file whether the http post did take place or not in the first place. Because if it fails to get an HTTPS post then also it sleeps indefinitely. following is the VT link and u can look up sandbox reports. It is important to note that instead of infostealing it injects and downloads more malware (as evident by few virustotal detections pointing to same as well). One of those payloads could be lumma or someother stealer.[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/db605eba071eeeb78c1aa93a018046699cca2a5260e9601f599cd96c55cccd9d/detection[/URL]</blockquote>

[QUOTE="Khushal, post: 1123205, member: 110394"] agreed obviously giving eset the crown is misleading. As far as kaspersky missing lumma stealer it possibly never didn't actually happen. First of all the malware supposedly missed in the video is cryptbot and what is interesting about this botnet is that it is VM aware and it checks first of all what processes are running in the system by sending a HTTP request. It then idles if it detects VM or an AV like Kaspersky and basically does nothing and a simple restart will remove all its traces. It would have been interesting to look what application control or intrusion detection control had to say about the file whether the http post did take place or not in the first place. Because if it fails to get an HTTPS post then also it sleeps indefinitely. following is the VT link and u can look up sandbox reports. It is important to note that instead of infostealing it injects and downloads more malware (as evident by few virustotal detections pointing to same as well). One of those payloads could be lumma or someother stealer. [URL unfurl="true"]https://www.virustotal.com/gui/file/db605eba071eeeb78c1aa93a018046699cca2a5260e9601f599cd96c55cccd9d/detection[/URL] [/QUOTE]

Verification