Samples missed by avast

[Maxx_original]

guys, don't turn this topic into a jungle

RejZoR: but there are new heur detections and modifications of current ones (some of them were not announced).. you're a lucky guy, if you haven't met any of them in-the-wild, but it doesn't mean that they're not effective or that they're not continuously tuned to reflect recent news from malware scene..

[RejZoR]

In fact i'm having a hard time finding a malware that others get from nowhere lol

Btw max, how come youu guys use [Susp] for some and [Heur] for others? As far as igor managed to answer me, they are the same thing, it just depends on the analyst who made the detection and which tag he uses. I know it doesn't make much difference to the most but if they are the same then i'd prefer one or another, not both at the same time.

[Maxx_original]

well, an example of Susp could be:

we can certainly identify a script obfuscator e.g. and we consider its usage/presence as (highly) suspicious.. so then we exactly detect the particular obfuscator and give it a suffix [Susp] (there was no heuristics involved in fact)

and an example of Heur:

we can process a file and if we think there's something fishy, we can go deeper and apply further analysis (emulation, generic unpacking) and collect necessary informations to find malicious behavior patterns etc. - but we don't focus on known suspicious obfuscators, packers here..

basically it could be considered as a difference between "known" and "unknown" threat types.. and of course there could be little deviations from these general rules

[Lisandro]

http://www.virustotal.com/file-scan/report.html?id=2ed7b857b9a435abe3cf3c324dfccfb1c5f1ddcfea6f27130daaa6f839de4bb2-1284358700
http://www.virustotal.com/file-scan/report.html?id=84796f4cbc78aa4aa329d26b48ec7470804a4b0a7d46795d3bf417a913fd7f4d-1284409282 (not sure about this yet).

[Maxx_original]

Tech, can you register at VT and write some metadata (where the file comes from etc.) to these analysis? when the file is called suspicious.exe and two engines detect it under such generic names, there's no clue what the file belongs to... it is very useful to know further informations when we're dealing with possible rogues

[Lisandro]

Tech, can you register at VT and write some metadata (where the file comes from etc.) to these analysis? when the file is called suspicious.exe and two engines detect it under such generic names, there's no clue what the file belongs to... it is very useful to know further informations when we're dealing with possible rogues

Answered by PM.

[RejZoR]

I was thinking, is there even a way to generically and with heuristics detect rogues? I mean they don't perform any malicious actions in general so you can't rely on that. But they are really annoying and latest versions even block IE and stuff like that. If there was a way to effectively block them it would be really great.

[Maxx_original]

RejZoR: we started an automated submission system of rogues (for v5 users) to get a fresh feed of samples few weeks ago.. some of them are well detectable due to their obfuscation, so there's not always a need to reach the lowest layer (but there are two ppl committed to analyze the capabilities of our generic unpacker and find interesting things inside the rogue samples).. this effort will probably not generate a big bang during one day, but there's a reasonable potential..

[Lisandro]

http://www.virustotal.com/file-scan/report.html?id=c18584a1e8de73da32ee00c77d965cc7e7d3c6da8879895e06dcd308944491b8-1284487084
http://www.virustotal.com/file-scan/report.html?id=434d058617518d8f17ff5a5511143f787acc6f52b527ca09af7a4828a5db36ca-1284487145

[Maxx_original]

xqrzd: new versions of Security tool should be detected generically now (Win32:MalOb-CM, Win32:MalOb-CN)

[Lisandro]

If it helps...
http://www.virustotal.com/file-scan/report.html?id=90f654e78fc562c9f2a141ab7353bcf9b8df7caab1e5e5077beec43ff2fd8612-1284553476

[Lisandro]

Please modify your post and remove the link to the malware download.

Not necessary. Better change http for hxxp in the link. Then avast team has the information of the source of the file in my opinion.

An example... http://forum.avast.com/index.php?topic=63894.0;topicseen

[DavidR]

Hardly what I would call an example, the same rule should apply send the sample directly to avast. Stopping the link being active doesn't stop it from being harvested and used maliciously.

[Lisandro]

Seems a dropper detected (mostly) by heuristics and not by signatures.
http://www.virustotal.com/file-scan/report.html?id=04cf094d7976f34f842549b282dba1092e74f80d364e6861a4110645b58fd5c0-1284584572

[Lisandro]

http://www.virustotal.com/file-scan/report.html?id=0186227586f243fb8ad1aa447cc0df226928fd00cc875a12a422bad8dabb42ff-1284623940