Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have detected a new virus that was sent to us by mail. The email contained a zip file which contains an executable with the same name. As a first step, we uploaded the file to virustotal, to be able to know if it was defined by any antivirus company. So far only 4 companies detected it:

(Antivirus : Name ):ESET-NOD32 : Win32/Crypt.NAC /Ikarus : Trojan-Spy.Agent /Sophos : Troj/Bredo-AKN / TrendMicro-HouseCall : TROJ_GEN.F47V1114

Does anyone know what does this kind of viruses do ?

Addition: We ran the Sophos scanner on potential infected PCs (Who unzipped the file). The scanning results implied that the PCs were clean, knowing that Sophos discovered the trojan in the first place.

share|improve this question
    
Do none of those websites give you any indication? –  Scott Helme Nov 15 '13 at 13:47
1  
Typically TrendMicro provides information on the virus found by providing a link for information. Here is what I found for the Trend Micro Trojan: about-threats.trendmicro.com/us/malware/troj_gen –  Ryan Nov 15 '13 at 13:47
    
@ScottHelme They didnt, i only found the names stated above –  Optimus Prime Nov 15 '13 at 13:54
add comment

2 Answers

up vote 2 down vote accepted

From some malware analysis lab. every day more then 68 % of malware goes undetected by any anti-virus.

How did you detect this one?

You may ask Fireeye an analysis of this malware.

share|improve this answer
    
Our email filter usually checks the zipped files and blocks the files containing an executable. We noticed that this executable was not blocked, the reason is that the zipped file is encrypted and has the decryption key when it is opened. This is how we noticed that something is odd. Next we executed the file on a virtual machine and nothing happened. That was when we came to the conclusion that this was a virus. –  Optimus Prime Nov 15 '13 at 14:32
2  
Since this malware is most probably a Trojan horse, the fact that apparently "nothing happened" is quite normal. Don't trust too much this "silence". –  daniel Azuelos Nov 15 '13 at 14:36
    
What question is this answering? –  Cory J Nov 15 '13 at 23:01
add comment

So if you've uploaded the file to VT and these are the hits you are getting back, likely you are hitting on heuristic-based signatures, meaning that this is some sort of a generic trojan.

You have a few options.

As stated, you can pass the suspected virus to a vendor for analysis. Fireeye isn't the only vendor that inspects malware. You can also pass your virus to folks at clamav for it to be in their sigs (warning: opinion ahead --) which is probably the best idea, since this virus was passed to you via e-mail and clam is almost exclusively used as a mail scanner (end opinion)

Another option you may have, if you want to give it a go is to pass it to anubis and download the report that says what the malware does when executed, and possibly include this report with whoever you send the virus to for analysis.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.