CyberCapture

[Milos]

Hello,
the sample did not do anything malicious in time of run in DeepScreen.

Milos

[Be Secure]

Hello,
the sample did not do anything malicious in time of run in DeepScreen.

Milos

But it should be blocked as Evogen[susp].

[jefferson sant]

I found this file by a single search result.The file has 91,3MB
There are 2 infections in this file.

The Zemana found attached

https://www.virustotal.com/en/file/24f0ef28bcc00d8eb2a2e3881a0a050eec0adbbc6b6a2f4c4b420fb50abd15d7/analysis/1473630666/

I did some tests on this and I just found the Malware.

WINWORD.EXE not detected by Avast.It is also not detected by Zemana.

https://www.virustotal.com/en/file/66ad25b71653e0f985abf64f37daa1dea5b3b585b80c40e30a9913ea7a3c6a77/analysis/1473630804/

CyberCapture would have to deal with file of this size. The analysis of the running time is sufficient to take action and determine if this file is malicious ?

[A. User]

So nice to see this technology. I've posted about it on the Comodo forums and haha, i didn't expected such a reply. Melih (their CEO) basically told me - oh are they going default deny? Because we have patents on Default Deny! Seems he didn't knew about CyberCapture before i have him the link to the blog post. Seems strange to me. LINK for CLICKING

[REDACTED]

So nice to see this technology. I've posted about it on the Comodo forums and haha, i didn't expected such a reply. Melih (their CEO) basically told me - oh are they going default deny? Because we have patents on Default Deny! Seems he didn't knew about CyberCapture before i have him the link to the blog post. Seems strange to me. LINK for CLICKING

I don't know if they have patents, but they are the perfect troll company.

 

[REDACTED]

What is the advantage of running webshield, should't the system shield do the same thing more or less?
Does cibercapture work without the webshield installed?

Two questions about CC:
1.Are files uploaded through secure connection?
2.How many files do you get through this feature everyday?

Hi.

ad 1) yes it's encrypted via our specific protocol
ad 2) couple of thousands a day

Couple of thousands a day? taking into account your user based isn't this number ridiculously low? it shouldn't be hard to setup servers tens of thousands of files per day

[Alikhan]

What is the advantage of running webshield, should't the system shield do the same thing more or less?
Does cibercapture work without the webshield installed?

Two questions about CC:
1.Are files uploaded through secure connection?
2.How many files do you get through this feature everyday?

Hi.

ad 1) yes it's encrypted via our specific protocol
ad 2) couple of thousands a day

Couple of thousands a day? taking into account your user based isn't this number ridiculously low? it shouldn't be hard to setup servers tens of thousands of files per day

At this moment of time CyberCapture only targets .exe files which have been downloaded via http(s).

In order for CyberCapture to work the Web Shield MUST be installed with Participate in Avast community enabled (which is by default).

You also need to understand that CyberCapture targets new or unknown files - in the future CyberCapture will trigger on other sources.

So if the file is already uploaded identified by hash, it won't be uploaded again.

[Pondus]

@jefferson sant   this seems like a false positive

First submission 2009-07-15 00:10:12 UTC ( 7 years, 2 months ago )

[jefferson sant]

@jefferson sant   this seems like a false positive

First submission 2009-07-15 00:10:12 UTC ( 7 years, 2 months ago )

Thanks.I have also reviewed some now with Hitman Pro
and have detected Malware.

[REDACTED]

What is the advantage of running webshield, should't the system shield do the same thing more or less?
Does cibercapture work without the webshield installed?

Two questions about CC:
1.Are files uploaded through secure connection?
2.How many files do you get through this feature everyday?

Hi.

ad 1) yes it's encrypted via our specific protocol
ad 2) couple of thousands a day

Couple of thousands a day? taking into account your user based isn't this number ridiculously low? it shouldn't be hard to setup servers tens of thousands of files per day

At this moment of time CyberCapture only targets .exe files which have been downloaded via http(s).

In order for CyberCapture to work the Web Shield MUST be installed with Participate in Avast community enabled (which is by default).

You also need to understand that CyberCapture targets new or unknown files - in the future CyberCapture will trigger on other sources.

So if the file is already uploaded identified by hash, it won't be uploaded again.

If I disable Avast community I can keep enable Cybercapture, are you sure is required? if is true then is a bug since avast doesn't alert you about this relation and people may think that they are using CC while they are not.

Still for me the volume of files is extremely low taking into account the volume manage by other companies only in new malware (not any suspicious file like CC should get). There are always other sources but still CC should be getting much more since it's a good source of 0 day malware.
http://www.securityweek.com/daily-new-malware-count-drops-15000-kaspersky
http://www.redsocks.nl/blog-2/malware-statistics-march-2016/
http://www.pandasecurity.com/mediacenter/press-releases/panda-security-detects-over-225000-new-malware-strains-per-day-in-the-first-quarter-of-the-year/

[Asyn]

So nice to see this technology. I've posted about it on the Comodo forums and haha, i didn't expected such a reply. Melih (their CEO) basically told me - oh are they going default deny? Because we have patents on Default Deny! Seems he didn't knew about CyberCapture before i have him the link to the blog post. Seems strange to me. LINK for CLICKING

Sorry, but your link doesn't work for me.
Either the topic got removed or it's located in a closed section.

OT: Seems Comodo forum uses an outdated version of SMF.

[Asyn]

If I disable Avast community I can keep enable Cybercapture, are you sure is required?

Yes, afaik.

[A. User]

So nice to see this technology. I've posted about it on the Comodo forums and haha, i didn't expected such a reply. Melih (their CEO) basically told me - oh are they going default deny? Because we have patents on Default Deny! Seems he didn't knew about CyberCapture before i have him the link to the blog post. Seems strange to me. LINK for CLICKING

Sorry, but your link doesn't work for me.
Either the topic got removed or it's located in a closed section.

OT: Seems Comodo forum uses an outdated version of SMF.

You have to register on their forums to be able to see it. 

[Eddy]

Still for me the volume of files is extremely low taking into account the volume manage by other companies only in new malware (not any suspicious file like CC should get).

The volume isn't low at all.
CyberCapture currently only checks .exe files

avast has a huge database with hash's
Files are only submitted/checked if they are unknown.
The fewer files are submitted, the more avast already know.
Note that it is the amount of files that is low, not the amount of hash's.

[bob3160]

So nice to see this technology. I've posted about it on the Comodo forums and haha, i didn't expected such a reply. Melih (their CEO) basically told me - oh are they going default deny? Because we have patents on Default Deny! Seems he didn't knew about CyberCapture before i have him the link to the blog post. Seems strange to me. LINK for CLICKING

You can expect almost anything from Melih.