https://www.virustotal.com/gui/file/dc287b1f38dfd32bdd479048022dba205674c378882867499ae216cbd251f6f5/detection
https://www.virustotal.com/gui/file/550ce115cebc5a59fa8ef847b035fcaa7b46de30d46d5a8f63f07fe00d96115e?nocache=1
https://www.virustotal.com/gui/file/9f999c9a2e16aa4482d655ffa54a0fdccbe62fac11c27200b821692ef26a9a8c/detection
please add the files to data bases is DANGEROUS.
Avast should get undetected samples from Virus Total.
L.S.
Delving into this a little bit deeper, we will find that
malware is always being launched from somewhere on the Interwebz.
So it comes in from a particular IP address.
Here one of that launching IP addresses is flagged as fraudulent (given by that particular VT analysis *:
https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/131.107.255.255
and as being confirmed here: https://www.virustotal.com/gui/url/8ac1e3b7689888afe41c46c03625268495c31263a5df2b23ab9c9a003bc5c553 *
(mentioned as a lokibot campaign address). Also: https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/20.99.184.37
and https://www.abuseipdb.com/check/20.99.184.37 (with malicious back-end servers involved).
See also: https://www.reddit.com/r/cybersecurity/comments/ywmon4/possible_hidden_malware_in_vm_detection_github/?rdt=60517
So there are more ways for avast to be aware of such samples and sources, but not all instances can come included in their definitions.
That is no excuse, but a practicality all and every AV solution have to keep up with.
That is why I like to include the safetoopen extension in the browser.
polonus
Any solution so that the antivirus can detect these dangerous samples?
Greetings.
You did notice that Avast doesn’t appear on the list of AVs on VT.
Essentially it doesn’t do the on-demand scan that is being done on VT, so it won’t appear on the list of AVs, not just AVs that don’t detect it.
I don’t know if it would detect in a live environment, with the Web Shield, File System Shield, Behaviour Shield, etc. - You can send samples direct to Avast:
Reporting a possible Malicious sample File or Website - https://www.avast.com/report-malicious-file.php.
From the link select File, Click Browse, that will open Explorer, select the file from the location you have it and Submit.