Solved This is not detected by Kaspersky for some strange reason...

[Xeno1234]

Hi, everyone! I've been testing this particular malware (VirusTotal) vs. kaspersky for some time now, always in a virtual machine environment, and I've come to this conclusion. This malware, for some really weird reason, is never properly detected via kaspersky signatures. However, it is detected by their system watcher. But, not for long...'cause if you keep launching it, even after reboot required by kaspersky, then sooner or later, all of your files end up encrypted (just try it...). Which brings me to my next point - maybe, just maybe, this particular malware is, for some unknown reason, is a part of some covert cyber operation. I mean, c'mon, just how f...ing hard can it be to properly analyse this very obvious malware (which is detected by your own systemwatcher) and to simply add it to your signature database. I mean, to me personally, this whole situation looks pretty ridiculous. If you wanna try it, just go ahead and download this batch: (removed). And then find, and keep launching the file I've been talking about.

Kaspersky is just an antivirus, its not perfect. I can give instances of Bitdefender and ESET having the same thing happen to it.
Its also detected by Kaspersky through System Watcher, so why are you complaining? Its still detected.

 

[ErzCrz]

Well, first of all, if You just wait for a bit longer, then the Portal detection result strangely disappears, and, for some mysterious reason, in the end, the detection outcome always comes up as perfectly clean. I've done that several times, and I've seen it enough times to claim what I've just said. How can You even say that it's detected by kaspersky portal, when, in fact, it isn't, and that the actual kaspersky application installed on a PC is not handling this obvious threat?

The portal is just their online analysis which checks it against signatures and does on the fly analysis. The VirusTotal just uses the AV basic detection engine. Of course, the full KIS product installed on your PC would protect you but it's not a product I use so I advise requesting their technical support or see if it's discussed in their forum. I was merely pointing out that it was showing as detected in their portal.

 

[Xeno1234]

The portal is just their online analysis which checks it against signatures and does on the fly analysis. The VirusTotal just uses the AV basic detection engine. Of course, the full KIS product installed on your PC would protect you but it's not a product I use so I advise requesting their technical support or see if it's discussed in their forum. I was merely pointing out that it was showing as detected in their portal.

I did put the hash in and its a clean verdict now. But they said it was detected by System Watcher, so its still detected anyway.
It wouldnt matter if it was missed either. Its an anti-virus, one file missed isnt the end of the world.

 

[Shadowra]

I can'T send you the links. ıt gives me error.
Btw one of the links on virustotal.
Link was sent to virustotal two days ago yet so far only one detection and no detection from major companies. It's frightening.

pm send

 

[OTTO]

pm send

I sent links. Thank you

 

[Shadowra]

I sent links. Thank you

Indeed, when downloading, a BMP is downloaded, Avast did not react on it.
I had fun analyzing it on VT... 0/70...

I've sent the links to Avast, thanks

 

[OTTO]

Indeed, when downloading, a BMP is downloaded, Avast did not react on it.
I had fun analyzing it on VT... 0/70...

I've sent the links to Avast, thanks

View attachment 280901

Thank you so much. I would be happy if you keep me posted about avast response.

 

[Pilot777]

The portal is just their online analysis which checks it against signatures and does on the fly analysis. The VirusTotal just uses the AV basic detection engine. Of course, the full KIS product installed on your PC would protect you but it's not a product I use so I advise requesting their technical support or see if it's discussed in their forum. I was merely pointing out that it was showing as detected in their portal.

Understood. Thank You. I was also simply pointing out that this malware analysis by Kaspersky Portal somehow always results as a clean sheet, even though it briefly shows the malware just as the exact detection You posted. Which is really weird...Briefly detected, and then gone for no apparent reason

 

[nickstar1]

does malwarebytes detect it on execution? not by virus total.

 

[Trident]

Can I have these files as well, I will test Check Point Harmony…

 

[Guilhermesene]

@Jonny Quest Did BD detect this?

 

[OTTO]

Can I have these files as well, I will test Check Point Harmony…

I sent links through pm.

 

[Jonny Quest]

@Jonny Quest Did BD detect this?

I'm not into malware testing like the more advanced members here are Also, as of now, I'm just running F-Secure and Kaspersky

 

[Xeno1234]

Can I have these files as well, I will test Check Point Harmony…

Could you check Kaspersky? Or use Harmony without its own native BB and Emulation?

 

[upnorth]

 

[harlan4096]

I shared links in private. These files are stated be privateloader and some of them loads malwares like vidar loader, redline stealer, risepro stealer etc. These malware files are not detected almost any antivirus. Avast blocks some of the links but some links. Kaspersky doesnt know about them. When i exposed smilar bmp files to bitdefender telemetry they started to get detected by bitdefender. Norton finds them suspicious. They are not detected by antivirus companies. I have found some research related to these files.
These bmp files are mentioned in the below links that i shared. They are dangerous.

New RisePro Stealer distributed by the prominent PrivateLoader

RisePro is a new undocumented stealer. According to SEKOIA.IO analysts, it has similarities with PrivateLoader.

blog.sekoia.io

Peeking into PrivateLoader

PrivateLoader's primary purpose is to download and execute additional malware for a pay-per-install (PPI) malware distribution service.

www.zscaler.com

About those very suspicious BMPs files, Kaspersky verdict in this question is:

We do not define this file as malware since it does not pose a threat to the computer since it is encrypted and does not have the ability to decrypt itself.

I think that's a pretty reasonable verdict. It does not make sense that the files victimized by the ransomware attack are detected as malware