75% of Malware Uploaded on “No-Distribute” Scanners Is Unknown to Researchers

guest · Jun 18, 2018

75% of Malware Uploaded on “No-Distribute” Scanners Is Unknown to Researchers
June 18, 2018
https://www.bleepingcomputer.com/ne...istribute-scanners-is-unknown-to-researchers/

[...] a no-distribute scanner is a service similar to a multiscanner, only that its operators modify the AV engines so they cannot report back to their respective vendors, hence limiting their ability to see the malware uploaded on such a service.
No-distribute scanner data is hard to come by
But besides not sharing data with AV makers, no-distribute scanners have another downside, and that's the fact they don't provide APIs or open their data to outsiders.

"Only 25 percent [of these files] can be found on at least one traditional multiscanner, while the remaining 75 percent have never been seen," Recorded Future experts said in a report last week.
Malware authors know better by now
First and foremost, this means that most malware authors are generally aware of the fact they should not upload their malware on multiscanners, especially in the in-dev and post-launch stage of their malware's development cycle.

Most companies will also need an astute threat intelligence hunting team that can track down these links wherever they might be shared and add detection for malware not uploaded on places like VirusTotal.
Click to expand...

itman · Jun 18, 2018

Further proof that VT should never be relied upon determining if software is malicious.

Log in or Sign up

75% of Malware Uploaded on “No-Distribute” Scanners Is Unknown to Researchers

guest Guest

itman Registered Member

Log in or Sign up

75% of Malware Uploaded on “No-Distribute” Scanners Is Unknown to Researchers

guest Guest

itman Registered Member

Useful Searches