avast! is missing one phishing email after another

Viruses and worms
21

Hi True Ind,

Kazy variants always a hard nut to crack for avast! especially within the Brazilian theater.
Then DrWeb is doing much better there: https://www.virustotal.com/nl/url/c0e76354c9080981eec81c3485fc872e95f91da0fa7b86ce77e4293ab71004be/analysis/1409934644/ given as a known infection source.
Landing here: htxp://rghost.net/57825839?r=3069 → http://sitecheck.sucuri.net/results/rghost.net
Compromised site.

See IP badness history: https://www.virustotal.com/nl/ip-address/89.248.225.50/information/
and http://www.herdprotect.com/ip-address-89.248.225.50.aspx

avaast! misses out here as well :o: http://www.herdprotect.com/win32.exe-14ddc1b69d46a87812708f260c1806e11cbf8bb9.aspx
keylogger distributed by htxp://rghost.net/download/56345393/…/Force Op Hack.exe

pol

22

Hi pol,

Thanks for the links.I know that signature has not been up to par with this isloated threat category.But local database isnt that bad on this category as it is being shown here.We are not very behind.With the on-exection technologies avast is just a little behind on banker malware.We tend to miss 2/10 samples every now and then with banker trojans which pretty good otherwise avast is been pretty wise in catching up.

Otherwise,we are doing fine in my research of banker testing against real-time avast product.I have faith in avast 2015 and all the new add on technologies to make a BIG difference.

23

This will only help if you also send the file to http://www.avast.com/contact-form.php
Otherwise, we can’t improve detection (or, can’t do it faster).

24

Well Lisandro,

That is why we are here in the first place to advance avast!'s detections and detection patterns. From the occasional comments from Milos I know the avast team is aware as what we are doing here. Also saw a serious drop in FP finds lately and no large update incidents so that side is running more smoothly also.

polonus

25

I have being sending files both by mail and the contact form. :slight_smile:

26

This would be difficult to detect.

This false bank email sends the user to hxxp://www.wildman.webd.pl/strony/massageteam/plugins/mvv/?/27095802
A “clean” one according to https://www.virustotal.com/en/url/9557bf554f60e865f8cb45fd356d5c7c2e4572fb910a18d088bb45cdbf62f2fa/analysis/1411081295/

Maybe Polonus could dig more about it…

27

Destination is a known spam source: http://www.projecthoneypot.org/ip_194.181.14.175

IP has also badness history: http://urlquery.net/report.php?id=1411162579183

Detected Detected a TDS URL pattern & Redkit Exploit on domains on IP.

polonus

28

Here,avast! caught this one:
https://www.virustotal.com/en/file/c92b81797cbe7a73defa6fa1e4679eb2abb9721d9eb96df456b4760543c7242d/analysis/1411524444/

But this is missed:
https://www.virustotal.com/en/file/862077fc99d87bb16d52d800f5fa28058927b37a909f0ff366bba6bc408e8f0f/analysis/1411524055/

reported to virus AT avast DOT com

29

Should this one also be reported: https://forum.avast.com/index.php?topic=155268.0
Or has the actual status changed: https://www.projecthoneypot.org/ip_46.252.18.198
and https://www.virustotal.com/nl/ip-address/46.252.18.198/information/

polonus

30

Another one for which we should establish the PHISH status: https://www.virustotal.com/nl/url/8c8515b70046ce7ac2847a2f82c5dd226d8ae0eb82a039749390e9213ad67a86/analysis/1411562710/
WOT is clear about this site: https://www.mywot.com/en/scorecard/lomaxx.fulba.com?utm_source=addon&utm_content=popup
with two red alerts
Nothing here: https://www.mywot.com/en/scorecard/lomaxx.fulba.com?utm_source=addon&utm_content=popup
nor here: http://app.webinspector.com/public/reports/25563174 & http://myip.ms/view/comp_ip/531277820/31.170.167.252
The adguard report flags an alert: http://adguard.com/en/adguard-report/lomaxx.fulba.com/report.html

IP badness history: https://www.virustotal.com/nl/ip-address/31.170.167.252/information/

polonus

31

Hi Pol,

As I said earlier in one my topics,avast’s reaction times have improved greatly because of backend technologies that we know as evo-gen and other filerep modules,we are one of the few now who detect this:
https://www.virustotal.com/nl/file/862077fc99d87bb16d52d800f5fa28058927b37a909f0ff366bba6bc408e8f0f/analysis/

https://www.virustotal.com/en/file/d90b181356088e1cb5423443ea38826673529245f0208b1b8daad446a3491a8a/analysis/

32

Another one.
This time, a .rar archive with a .cpl file inside.
Into Email Shield, all packers are selected and also PUPs.

Detection ratio: 18 / 45
https://www.virustotal.com/en/file/7b2823d0472c319376a4dc8dbb00d3fec471a2b75b963692559a3b0abf872394/analysis/1414246360/