Samples missed by avast (VirusTotal links only!)

[polonus]

Malicious Flash_Player_10.2_update_for_Win.exe not detected by avast as Win32:Renos variant...
see: http://www.virustotal.com/url-scan/report.html?id=48cb08b5fffd3b0c69f9662e2b1d8da5-1300651632
file analysis: http://www.virustotal.com/file-scan/report.html?id=8801fb51b54dc45069154d262135e1ddd77d2142aa8cb1a70e3e56bf3222d07b-1300655236
See: http://www.sophos.com/security/analyses/viruses-and-spyware/malfakeaviz.html?_log_from=rss
Also found to be suspicious here: http://wepawet.iseclab.org/view.php?hash=48cb08b5fffd3b0c69f9662e2b1d8da5&t=1300655461&type=js
Acompanying Anubis report here: http://anubis.iseclab.org/?action=result&task_id=1e47e25cfa4212b94d5c0dbfb942b6e07

polonus

[polonus]

This parasitic virus that infects Win32 PE executable files missed by avast, see: http://www.virustotal.com/url-scan/report.html?id=0fada3e4220ae5e9bb7e9a0f255115de-1300726070
file analysis: http://www.virustotal.com/url-scan/report.html?id=0fada3e4220ae5e9bb7e9a0f255115de-1300726070
= 2011-03-21 16:52:06   htxp://nutromchuu.co.cc/release/d2f0b5c46987429e2ad87a745a130a92/Internet-Explorer_update.exe   2D7307DCB9E615FFD1A28C3089F9CA4A   46 . 16. 240. 3    UA   JSSality.AO
See: http://wepawet.iseclab.org/view.php?hash=0fada3e4220ae5e9bb7e9a0f255115de&t=1300729945&type=js  (suspicious}
accompanying Anubis report to be found here: http://anubis.iseclab.org/?action=result&task_id=1cd3f576f2e1d72d4b1515c19f4c57216
see: htxp://jsunpack.jeek.org/dec/go?report=519636b9a472c69744b37908c41fe4409ab1c24c (this link only for experienced users)

polonus

[polonus]

Here this suspicious IRCBot malware was not detected. Resides here: 2011-03-13 01:49:03   hxtp://www.etoro.com/SDL/typeC/eToro1140.EXE   AA34FA609C772A1A75960912A863E7AC   188. 95. 97. 212   NL   PHPIRCBOT.CE   

See url scan: http://www.virustotal.com/url-scan/report.html?id=58a3500d79093f8d48f351b8b2618894-1300739399
File analysis scan: http://www.virustotal.com/file-scan/report.html?id=6492099ee8a84d0a6e7c9152d44517444a8906244197a8453be52b29830c3311-1300743017
Suspicious: http://wepawet.iseclab.org/view.php?hash=58a3500d79093f8d48f351b8b2618894&t=1300743150&type=js
Anubis report: http://anubis.iseclab.org/?action=result&task_id=152b9df0e8a5515c4ed6a81498033f41c
 
Sig buster output: Wise_Installer vna SN:1361

another example of PHPIRCBOT.CE can be found here:
 htxp://2gov.co.cc/pk2/ktytyvjlfli see for this: http://www.malware.pl/report/195.80.151.83

polonus

[Marc57]

Rogue Installer.

http://www.virustotal.com/file-scan/report.html?id=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301111394

[polonus]

Nice find, Marc57,

Good to give a couple of the resources where this malware is treated:
htxp://malc0de.com/database/index.php?search=KR&CC=on
Go there only if you are security aware enough and know what not to click and better even what not...
and then we will land here:
htxp://malc0de.com/database/index.php?search=vaccinescan_set (for experienced users only)
where we have 5 variants with ThreatExpert reports,
If we do a bit of reconaissance we see the malware site 124. 217. 218. 10 is down, so that makes the
find a bit more irrelevant. But there seems still activity from there:

htxp://down.rprotect.co.kr/rprotect/rpwacherh.dll
trojan fake-alert see: http://www.virustotal.com/latest-report.html?resource=f920958410f6ebaddfc9a1a4d66db082
Which avast naturally detects as Win32:Adware-gen
Do not visit that site, because it also infects with Win32:Virtob
see: http://www.virustotal.com/file-scan/report.html?id=9f1410c3796ddf9348f7a0bcc85a381b500d639b550918797f2abbd65e47a1d1-1299580539
So also neatly detected by good old avast, because we can only detect what is there,
and dead links or malware sites that have been brought down do not count...
But let us see if "vaccinescan_set_etc." resides somewhere else and is alive?
4 alive of 5 found at malware for domain search:
virustotal reports for the live ones are not very, very promishing,
so we see how important Marc57's posting was:
http://www.virustotal.com/file-scan/report.html?id=395feefcaa6ab9a02d489bbe03826e6df1bb6cda20087bc4dfec471341ddfa85-1300866728
&
http://www.virustotal.com/file-scan/report.html?id=8212515ad446410f6d47e9eae6eb4906fa9532b5e4952b28d843fd86b5dccfb5-1300853172
&
http://www.virustotal.com/file-scan/report.html?id=21b7dfcc8b2572ab78a30e4e7974a60998841c7d8ef7f746310d0813c6cdb445-1300853156
&
here detection is slightly better with 10 /42 (23.8%)
but avast misses it altogether:
http://www.virustotal.com/file-scan/report.html?id=bf12984f90b2c8afb8f3b5a5149eabc9c979a61736b2f414d444b6903a4135d3-1301117268

So sometimes it is worth delving a bit deeper with our cold renaissance methods,

polonus

[polonus]

Oh and just another thing, if you know where to look, you can even find some binairies for the malware that
Marc57 found, let's see, here:  http://report.xandora.net/xangui/malware/view/efaeff5a90c6173b0b92d338b598f2f6

polonus

[polonus]

Here malware is residing at hxtp://cfteam.net/test/futurepack/tscplus.exe
Nice article on this malware can be found here:
http://www.offensivecomputing.net/?q=node/1448
See virustotal results here: http://www.virustotal.com/file-scan/report.html?id=84937ad73b04cf21c4bd9347ae4aeea578fe13db5cb8b7cae9fc72e1c0085ea2-1266518648
avast not detecting...
ThreatExpert report here: http://www.threatexpert.com/report.aspx?md5=b120c36aed67701358ad92e70f051820
Xandora does not have it yet, wepawet gives it as suspicious:
http://wepawet.iseclab.org/view.php?hash=1327791e62383cad70171e3ca315685e&t=1301178928&type=js
Anubis report: http://anubis.iseclab.org/?action=result&task_id=1e85aa90196fe77b41143c0da86cdd561&format=html

and look here: http://www.prevx.com/filenames/186858952724755476-X1/TSCPLUS.EXE.html

polonus

[polonus]

This zbot detection missed: http://www.virustotal.com/file-scan/report.html?id=28ef64ff922b12a8ecbe261f8046745f7f8ece9b8a1bfabf816984620a219436-1301236544

malware found to reside here:
htxp://rtfsti.com/fb/comments/facebook.update.utility.exe

See: http://info.prevx.com/aboutprogramtext.asp?PX5=3F9CD08D0002F9FB182F02B901BA7D0045ACED23

Here avast finds another variant:
http://www.virustotal.com/file-scan/report.html?id=81b65dd4f92fc29ba3f8062ed69fcb89a703e1c7d1ded2ff956aee11d5a2c0f1-1300555240

There is a lot of variety in this malware: (searched for W32/Pinkslipbot.gen.ae):
http://xandora.net/xangui/malware/search?by=name&keyword=W32%2FPinkslipbot.gen.ae

polonus

[danny96]

Rogue Installer.

http://www.virustotal.com/file-scan/report.html?id=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301111394

This one is detected
There is a more up-to-date report (13/42) for this file.

[polonus]

Detection for vaccinescan_setup.exe as mentioned by danny96,

http://www.virustotal.com/file-scan/report.html?id=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301111394
avast detect since:
http://www.virustotal.com/file-scan/report.html?id=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301236936

But from this domain this is still up: htxp://down.vaccinescan.co.kr/app/down/vaccinescan_setup.exe
virustotal result: http://www.virustotal.com/file-scan/report.html?id=bf12984f90b2c8afb8f3b5a5149eabc9c979a61736b2f414d444b6903a4135d3-1301226435
and
http://www.virustotal.com/file-scan/report.html?id=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301080931

ThreatExpert analysis: http://www.threatexpert.com/report.aspx?md5=41216f1f6e0358eaadd1d6782963e330

This new variant not detected ny avast

See: http://camas.comodo.com/cgi-bin/submit?file=bf12984f90b2c8afb8f3b5a5149eabc9c979a61736b2f414d444b6903a4135d3
and http://camas.comodo.com/cgi-bin/submit?file=dc6261c9d0b8d0f486ce55f8d191b96439007569df516087412cd3fb00462350-1301080931

description: http://www.norman.com/security_center/virus_description_archive/79262/nl  (norman detects this
malware)

polonus

[polonus]

This malware resides here: htxp://youtub.hi2.ro/Client.jar  (JAVA_DLOADER.VTG)
See: http://www.virustotal.com/file-scan/report.html?id=35970e91c4d3364f8b05f5b40d892224084c7fc207af4db8165ebf6ca9bd5357-1301338614
See: http://wepawet.iseclab.org/view.php?hash=145d4e3fc6a7adc87d664b817fa57f08&t=1301342685&type=js
also found here: htxp://86.96.195.185/Client.jar
http://www.virustotal.com/latest-report.html?resource=a6091a6335ec1fd34e8358010c044270
&
htxp://bejn.fileave.com/Client.jar
http://www.virustotal.com/latest-report.html?resource=0521c911e442cd9eec927d8439731a76
&
htxp://80.74.139.159/joomla1/tmp/sernac/cl/informes/Client.jar
http://www.virustotal.com/file-scan/report.html?id=35970e91c4d3364f8b05f5b40d892224084c7fc207af4db8165ebf6ca9bd5357-1301339415
&
htxp://www.tinyology.eu/biliard/Client.jar
http://www.virustotal.com/file-scan/report.html?id=35970e91c4d3364f8b05f5b40d892224084c7fc207af4db8165ebf6ca9bd5357-1301339415

polonus

[Burkoff]

http://virusscan.jotti.org/en/scanresult/397d3a1752993f12d11499c860944b2fa3b923c5

http://virusscan.jotti.org/en/scanresult/d7929e26d39b47efdf14bc6848601ba81b312129/4b736f82be65d609f35f17e2785cd78047059860

http://virusscan.jotti.org/en/scanresult/5ab878a34f0ccc12367fcdd76af6a6e33c3346d2/57cbac84f39be03486b7d849bfdeb89bb4b1ab7b

http://virusscan.jotti.org/en/scanresult/6089fb91fbeb68c3bdf024c43f1f8fcd3c75884f/abfe303db49b96d3b83fff02e27de2cc2211c4bd

http://virusscan.jotti.org/en/scanresult/53a76d9807b6f542263639c14362087cd00b6192

http://virusscan.jotti.org/en/scanresult/a41f5aa76ceb8da0b2442f5aedc08487d46fff2d

http://virusscan.jotti.org/en/scanresult/51227e87ab211b9870023fadf3014200b6fda9f8

sent to avast!

[Lisandro]

Thanks Burkoff for helping improving detection

[polonus]

Another one here: https://www.vicheck.ca/md5query.php?hash=43cb55861b7fcf1dfb6968c9ef110bcc
with VT results here: http://www.virustotal.com/file-scan/report.html?id=d4abc27a80312e066fc816e537394a33719b8ac11f5d277dc26f88a899548dad-1304483504  new Spy.Spyeye variant...

polonus

[polonus]

Is this being detected, see: http://wepawet.iseclab.org/view.php?hash=a0beb67f63645e5251c6df9bd5334ab0&t=1304632923&type=js

See: http://www.virustotal.com/url-scan/report.html?id=81647288eaf692b562bedd017aa95f67-1304625248

webshield should flag Java Deployment Toolkit

polonus