3 ms·

Never use VirusTotal in its current form on sensitive files. Everything uploaded goes to their subscription feed. I see corporate documents that should not be o

Never use VirusTotal in its current form on sensitive files. Everything uploaded goes to their subscription feed. I see corporate documents that should not be out in the open, for example, pass through every day. Anyway, do any of the AV scanners VirusTotal wraps around even handle Android malware?

daeken 14y ago
> Anyway, do any of the AV scanners VirusTotal wraps around even handle Android malware? The submission has a table showing which malware was picked up by which AVs, and quite a few of them did a good job with it.
- FreakLegion 14y ago
  Ah, thanks! I glanced through and only saw AV1, AV2, etc. The paragraph above puts names to them, and at least some of those are indeed in VirusTotal. One thing I forgot to mention before: using hashes to identify malware is just not effective in the least Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. 1. It may need to be remapped to virtual address order and PE-formatted. I've never tried it with raw pages.
  - daeken 14y ago
    > Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. I was referring to the method they currently use, which is just matching hashes, not VirusTotal. No matter what, you need to somehow run the code through an antivirus at some point, so the files need to go up to the server or you need to run the AV locally.

daeken 14y ago

> Anyway, do any of the AV scanners VirusTotal wraps around even handle Android malware? The submission has a table showing which malware was picked up by which AVs, and quite a few of them did a good job with it.

FreakLegion 14y ago
Ah, thanks! I glanced through and only saw AV1, AV2, etc. The paragraph above puts names to them, and at least some of those are indeed in VirusTotal. One thing I forgot to mention before: using hashes to identify malware is just not effective in the least Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. 1. It may need to be remapped to virtual address order and PE-formatted. I've never tried it with raw pages.
- daeken 14y ago
  > Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. I was referring to the method they currently use, which is just matching hashes, not VirusTotal. No matter what, you need to somehow run the code through an antivirus at some point, so the files need to go up to the server or you need to run the AV locally.