4 ms·
To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing scan-time results, not run-ti
by iancarroll 12y ago
To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing scan-time results, not run-time results. These 'crypters' are also effectively worthless - as soon as your sample hits a few computers an AV will upload the sample (or someone will upload it to VirusTotal, and it will subsequently get analyzed) and it will be flagged.
You can almost try this 'at home' - upload a file to VirusTotal and try to get it to match two or three AV's detections. It will then be flagged by at least ten AVs next week. This is because VirusTotal shares all uploaded files with antivirus products.
- lqdc13 12y agoYou can see that the file that got flagged in September still isn't flagged by all AVs: https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9f6daf07ccacfd653450615f82f8a691d3a9ecfd/analysis/ https://www.virustotal.com/en/file/e2b8ecc843fa8156a8c06e7d9... Another example: This one marked by 2 AVs (malwarebytes and Bkav) in September. A month later it was only marked by 3. https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe254ed2b05a1098a86b6ac3e654cf9978739ae704/analysis/ https://www.virustotal.com/en/file/e5712fc604d6285038c6a7fe2...
- Terr_ 12y agoI remember reading some fictional story where the hacker designed a easily-detectable virus, whose true payload was the signature the AV system generated from it. The carefully-crafted signature would exploit a buffer-overflow in the anti-virus clients as soon they got their regular updates from the central server. Far-fetched but not impossible. I wish I could remember the source.