3

We have detected a new virus that was sent to us by mail. The email contained a zip file which contains an executable with the same name. As a first step, we uploaded the file to virustotal, to be able to know if it was defined by any antivirus company. So far only 4 companies detected it:

(Antivirus : Name ):ESET-NOD32 : Win32/Crypt.NAC /Ikarus : Trojan-Spy.Agent /Sophos : Troj/Bredo-AKN / TrendMicro-HouseCall : TROJ_GEN.F47V1114

Does anyone know what does this kind of viruses do ?

Addition: We ran the Sophos scanner on potential infected PCs (Who unzipped the file). The scanning results implied that the PCs were clean, knowing that Sophos discovered the trojan in the first place.

Improve this question
3
  • Do none of those websites give you any indication?
    – Scott Helme
    Nov 15, 2013 at 13:47
  • 1
    Typically TrendMicro provides information on the virus found by providing a link for information. Here is what I found for the Trend Micro Trojan: about-threats.trendmicro.com/us/malware/troj_gen
    – Ryan
    Nov 15, 2013 at 13:47
  • @ScottHelme They didnt, i only found the names stated above
    – Optimus Prime
    Nov 15, 2013 at 13:54

2 Answers 2

Reset to default
2

From some malware analysis lab. every day more then 68 % of malware goes undetected by any anti-virus.

How did you detect this one?

You may ask Fireeye an analysis of this malware.

Improve this answer
3
  • Our email filter usually checks the zipped files and blocks the files containing an executable. We noticed that this executable was not blocked, the reason is that the zipped file is encrypted and has the decryption key when it is opened. This is how we noticed that something is odd. Next we executed the file on a virtual machine and nothing happened. That was when we came to the conclusion that this was a virus.
    – Optimus Prime
    Nov 15, 2013 at 14:32
  • 2
    Since this malware is most probably a Trojan horse, the fact that apparently "nothing happened" is quite normal. Don't trust too much this "silence".
    – dan
    Nov 15, 2013 at 14:36
  • What question is this answering?
    – Cory J
    Nov 15, 2013 at 23:01
2

So if you've uploaded the file to VT and these are the hits you are getting back, likely you are hitting on heuristic-based signatures, meaning that this is some sort of a generic trojan.

You have a few options.

As stated, you can pass the suspected virus to a vendor for analysis. Fireeye isn't the only vendor that inspects malware. You can also pass your virus to folks at clamav for it to be in their sigs (warning: opinion ahead --) which is probably the best idea, since this virus was passed to you via e-mail and clam is almost exclusively used as a mail scanner (end opinion)

Another option you may have, if you want to give it a go is to pass it to anubis and download the report that says what the malware does when executed, and possibly include this report with whoever you send the virus to for analysis.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .