4 ms·
Of the variants listed: https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14edf09794fa76a71cb04348d2a332991f3fceab2b https://www.virustotal.com/gui/fil
by technion 4y ago
Of the variants listed:
https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14edf09794fa76a71cb04348d2a332991f3fceab2b https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14... 25/66 detection. Detected by Windows Defender free version if you do nothing but leave it in a default configuration and don't install a competing product.
https://www.virustotal.com/gui/file/40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3 https://www.virustotal.com/gui/file/40de45ea45d352703a19c4a5... 30/64, as above detected by Defender
https://www.virustotal.com/gui/file/500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686 https://www.virustotal.com/gui/file/500905187d6b2d387fed36c8... 31/67, as above Defender
2410D0D7C20597D9B65F237F9C4CE6C9 - never seen by Virustotal. So yes, it probably has poor detection.
- aasasd 4y agoIsn't detection by about half of the engines the normal state of things on Virustotal?
- technion 4y agoYes, but many of these products are meme products. I'd like to say "No enterprise is running SUPERAntiSpyware on their Microsoft Exchange cluster" but I'm aware of one that is. In general though, half the engines is actually a place where I'd dispute the "poorly detected" description. This what poor detection looks like after an IR investigation and opening tickets with several vendors two months ago. https://www.virustotal.com/gui/file/d8ac4f43a5279e3aa33b2a743e17e1c59ba170c74965c45feca529fd8e817140 https://www.virustotal.com/gui/file/d8ac4f43a5279e3aa33b2a74...
- vient 4y agoThe key sentence is > First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services. Of course by now majority of AVs detect those files, detections spread rather quickly between AVs. Sadly, VirusTotal seems to show detection history only to registered users. I can confirm that at least second sample still had 0 detections in April.