Worm:JS/Bondat not detected

[REDACTED]

I've foud a worm detected by MS Defender as Worm:JS/Bondat that doesn't get detected by Avast.
This worm infects mainly in thumb drives

https://drive.google.com/file/d/17sVUA6GrW1EeiMJmh4mAtPQ3vtOLikyN/view?usp=sharing (password: virus)

[polonus]

Here on VT avast does not detect this: https://www.virustotal.com/pl/file/c823dfff4415a07b6c738e5cc8cad1282d1f2f54ab50c8206fe5763f2bc56bdb/analysis/

But it could well be it detects in pup-mode. It is Bitcoin virus, so a mining blocker will help: -myvtfile.exe is a sort of malicious software that mines digital currency. -> https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coin-miner-javascript-infection.html

polonus

[Asyn]

You can report a suspicious/malicious sample (File/Website) here: https://www.avast.com/report-malicious-file.php

[savcin]

Detection has been created.

[REDACTED]

Thank you all!

@asyn the file has been sent through this link, but since it doesn't provide any feedback I thought that a forum post could provide feedback to other users with the same issue.

[Pondus]

Here on VT avast does not detect this: https://www.virustotal.com/pl/file/c823dfff4415a07b6c738e5cc8cad1282d1f2f54ab50c8206fe5763f2bc56bdb/analysis/

But it could well be it detects in pup-mode. It is Bitcoin virus, so a mining blocker will help: -myvtfile.exe is a sort of malicious software that mines digital currency. -> https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coin-miner-javascript-infection.html

polonus

Not bitcoin related

Info  >>  https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AJS%2FBondat

Payload
Steals information about your PC

The worm collects information about your PC, including:

Malware version
User name
Computer name
Product ID
Infection GUID
Language/localization (for example, "0409" for "en-us")
Operating system version (for example, "5.1.2600.0")
This information is encoded using the RC4 algorithm, plus another custom encoder, and sent to a remote server through HTTP POST. The server's URL is hardcoded in the malware body.   

Symantec info  >>  https://www.symantec.com/security-center/writeup/2015-021912-5112-99

[Asyn]

@asyn the file has been sent through this link, but since it doesn't provide any feedback I thought that a forum post could provide feedback to other users with the same issue.

OK, thanks for the report.