4 ms·

I am not a proper developer so I don't have the technical details on this, but another thing I have seen done is to buy access to an API on VirusTotal [1] and s

I am not a proper developer so I don't have the technical details on this, but another thing I have seen done is to buy access to an API on VirusTotal [1] and submit file hashes to be compared against their database of about 70 or so virus scanners. Not foolproof, as malware can be recompiled and hidden from VT until the actual file is submitted for sandbox analysis which you probably dont want to do with potentially sensitive data so it really only catches known-knowns but apparently some companies find it useful. I utilize it on a windows machine using ProcessExplorer that can automatically submit hashes but the API volume is limited for free / anonymous access. [1] - https://docs.virustotal.com/reference/overview https://docs.virustotal.com/reference/overview

toomuchtodo 2y ago
CISA is offering a malware analysis service now, requires a Login.gov account to use and the user be a US citizen. Unsure how it compares to VirusTotal, it’s in our backlog to spike a poc in our IR workflow. https://www.cisa.gov/resources-tools/services/malware-next-generation-analysis https://www.cisa.gov/resources-tools/services/malware-next-g...
- yard2010 2y ago
  I have to say this user agreement sounds like TikTok privacy policy, but my oh my! The government does its job. RESPECT.
rpigab 2y ago
If I was a malware distributor, I'd just throw a couple random bytes at the end each time I upload a malicious file, it'd still work and have a different checksum/hash.
- ecaradec 2y ago
  Antivirus are really stupid tools, but not that stupid. I said that from a time where I had to work around tools flagged by antivirus. Among stupid things they do are flagging a part of an executable, some nsis plugin flagged the whole package as virus as soon as you included them. I think they probably hash files by chunks, if you have too many bad chunks then you are a virus. A few bytes at the end doesn't change that.
  - eyegor 2y ago
    I'm not sure if it's still true, but it used to be that ~half of all antivirus would flag an executable if you compressed it with UPX.
    - cinntaile 2y ago
      You could sometimes bypass this by opening the file with a hexeditor and change a meaningless value. When UPX was popular there were also alternative file compressors that could also be used to sometimes bypass this issue.

toomuchtodo 2y ago

CISA is offering a malware analysis service now, requires a Login.gov account to use and the user be a US citizen. Unsure how it compares to VirusTotal, it’s in our backlog to spike a poc in our IR workflow. https://www.cisa.gov/resources-tools/services/malware-next-generation-analysis https://www.cisa.gov/resources-tools/services/malware-next-g...

yard2010 2y ago
I have to say this user agreement sounds like TikTok privacy policy, but my oh my! The government does its job. RESPECT.

rpigab 2y ago

If I was a malware distributor, I'd just throw a couple random bytes at the end each time I upload a malicious file, it'd still work and have a different checksum/hash.

ecaradec 2y ago
Antivirus are really stupid tools, but not that stupid. I said that from a time where I had to work around tools flagged by antivirus. Among stupid things they do are flagging a part of an executable, some nsis plugin flagged the whole package as virus as soon as you included them. I think they probably hash files by chunks, if you have too many bad chunks then you are a virus. A few bytes at the end doesn't change that.
- eyegor 2y ago
  I'm not sure if it's still true, but it used to be that ~half of all antivirus would flag an executable if you compressed it with UPX.
  - cinntaile 2y ago
    You could sometimes bypass this by opening the file with a hexeditor and change a meaningless value. When UPX was popular there were also alternative file compressors that could also be used to sometimes bypass this issue.