13

I have a new piece of malware that isn't detected by current anti-virus vendors. How do I report it to them?

I want to do a good turn and help protect as many people as possible. What is the best and easiest way to get it to as many anti-virus vendors as possible, to help them detect it? Is there a list of sites where I should upload the sample, or email addresses where I should send it to?

I know about Virustotal. I could submit the sample to Virustotal. Will that be sufficient? Currently few or no antivirus engines detect this malware. Will submitting the sample be enough for antivirus engines to know that it is malicious and should have been detected, and trigger them to analyze it and develop a signature/detector for it?

(It's not obvious to me how anti-virus vendors would know that my sample is malicious, just because it was uploaded to Virustotal. I didn't see any user interface in Virustotal where I indicate "yes, this really is malicious, even though no one detected it", so I wonder if it will get lost in amongst all the other benign samples. I've heard of plenty cases of malware that had been uploaded to Virustotal for months or years before any antivirus engine started detecting it. So it makes me wonder whether uploading it to Virustotal is enough.)

I've looked, but I haven't found an answer on this site. Here's what I found:

  • Where to report malicious URLs, phishing, and malicious web sites? provides a list of where to report phishing web sites and other malicious web sites, but it doesn't say where to submit malware samples.

  • Unknown malware, how to report it and whom to report it to? asks a related question in a more specific situation. One answer mentions Virustotal, but it doesn't answer my question of whether submitting to Virustotal actually works, in terms of notifying A/V vendors to trigger analysis. Another answer gives links to forms where you can upload malware samples to two anti-virus vendors, but that's just two of the dozens of vendors out there -- if I need to submit directly to A/V vendors, I am hoping for a more comprehensive list that is easy to refer to.

0

4 Answers 4

7

Note: All the information on this post has been copied from the TechSupport article here.

Every major antimalware vendor has a dedicated E-mail address through which new samples can be submitted. The procedure is as follows:

  1. Configure your Email client
  2. Make a password protected archive and add the sample to it. The password should be "infected".
  3. Send the sample to the following email addresses, with the subject "The password is infected":

Ahnlab Antivirus - [email protected]
AVAST Antivirus - [email protected]
Avira Antivirus - [email protected]
Bit Defender - [email protected]
Bluepoint Security - [email protected]
Comodo Antivirus - [email protected]
Dr Web - [email protected]
EMCO Antivirus - [email protected]
Emsisoft Antivirus - [email protected]
eSafe Security - [email protected]
eScan Antivirus - [email protected]
Fortinet Antivirus - [email protected]
Spy Emergency - [email protected]
F-PROT Antivirus - [email protected]
FSB Antivirus - [email protected]
F-Secure - [email protected]
Orbitech Hazard Shield - [email protected]
IKARUS Security Software - [email protected]
Immunet Antivirus - [email protected]
K7 Antivirus - [email protected]
Kaspersky - [email protected]
Jiangmin Antivirus - [email protected]
Lavasoft Antivirus and Antimalware - [email protected]
McAfee Avert Stinger - [email protected]
Micropoint Anrivirus - [email protected]
Microsoft Security Essentials - [email protected]
Nano Antivirus - [email protected]
ESET Antivirus - [email protected]
Noralabs Norascan Antivirus - [email protected]
Norman Security Suite - [email protected]
enter link description herenProtect - [email protected]
Panda Security - [email protected]
Psafe Total - [email protected]
360Safe - [email protected]
Rubus Ozone Antivirus - [email protected]
Smartcop Antivirus - [email protected]
Sophos - [email protected]
Spybot Search and Destroy - [email protected]
SRN Micro Antivirus - [email protected]
Symantec Antivirus - [email protected]
Moosoft Antivirus - [email protected]
Hacksoft Antivirus - [email protected]
Thirtyseven4 Antivirus - [email protected]
CA Technologies - [email protected]
Trojan Hunter - [email protected]
Simply Super Trojan Remover - [email protected]
Filseclab Antivirus - [email protected]
ThreatTrack Security - [email protected]
ViRobot Antivirus - [email protected]
Virus Block Ada - [email protected]
Webroot Antivirus - [email protected]
Zillya! Antivirus - [email protected]
Kingsoft Antivirus - [email protected]
MKS - [email protected]
Aegislab Antivirus - [email protected]
Quick Heal Antivirus - [email protected]
Outpost Antivirus - [email protected]
Baidu Antivirus - [email protected]

5

TL;DR: I would suggest that submitting to VirusTotal is enough.

Details:

Because there are so many samples of malware and the fact that each binary in modern malware campaigns can be tested to be FUD (fully undetectable), VirusTotal is your best best I would argue. It may or may not be picked up by vendors, but this gives you the best shot of doing some good.

Here is a older link speaking to FUD and why your sample might not be detected: http://www.symantec.com/connect/blogs/fully-undetectable-cryptors-and-antivirus-detection-arms-race

My only caveat to this recommendation would be if you think you have something really interesting or unique (think Flame, Stuxnet, etc.). If that is the case, I would suggest contacting a vendor directly and provide some evidence of why you think this is unique.

Here is some information from VirusTotal about what/who they share with (https://www.virustotal.com/en/about/):

VirusTotal and confidentiality

Files and URLs sent to VirusTotal will be shared with antivirus vendors and security companies so as to help them in improving their services and products. We do this because we believe it will eventually lead to a safer Internet and better end-user protection.

By default any file/URL submitted to VirusTotal which is detected by at least one scanner is freely sent to all those scanners that do not detect the resource. Additionally, all files and URLs enter a private store that may be accessed by premium (mainly security/antimalware companies/organizations) VirusTotal users so as to improve their security products and services.

Hope that helps!

4
  • I confess I don't understand your argument why submitting to VirusTotal is enough. Can you explain? I know about FUD; but I don't see how/why that implies that submitting to VirusTotal is sufficient, or how it relates to this question.
    – D.W.
    Jul 9, 2014 at 4:09
  • Hi DW, I am suggesting VirusTotal is enough because you get the most centralized coverage of any place (that I know of) and those samples are available to those vendors. My comment about FUD was just to say that there are so many samples, VirusTotal appears the best way to handle submissions en masse. From another point, VT is the best option because the only other options are a) do nothing b) submit to a smaller, less centralized resource or c) try to email to a vendor and justify why this is really special and needs to looked at carefully.
    – you
    Jul 9, 2014 at 4:16
  • Well, this doesn't answer my question. The problem is, people upload benign .exe's to VirusTotal, too (e.g., to check them), so the .exe's on VirusTotal are a mixture of benign and malicious. They are not labelled: when I upload a .exe, there's no way to mark it as malicious. So, yes, A/V vendors can download all those .exe's (the mixture of malicious and benign ones), but how would they know which ones are malicious? How would they know that the one I uploaded is actually malicious and should have been detected? Seems like they can't know that, so I'm not sure uploading to VT is enough.
    – D.W.
    Jul 9, 2014 at 17:00
  • I'm not happy with submitting only to VirusTotal. I just ran across a bit of malware that was first submitted to them over a year ago and today got only 3/53. This doesn't seem to be a very fast method of submission. Nov 23, 2014 at 1:34
4
  1. http://www.uploadmalware.com/
  2. http://www.virussign.com/
  3. https://www.mywot.com/wiki/Malware_submission

Hope that this is enough, you may want to make your own publication about this malware after time you can put it into your CV.

1
  • Excellent! The uploadmalware.com and mywot.com links look very helpful. For Virussign, I couldn't find a place to upload anything: did I miss it?
    – D.W.
    Jul 9, 2014 at 17:03
0

Anti-virus companies have a 'submit a sample' option but don't expect them to review it by hand in detail. They have automated dynamic behaviors analysis tools (i.e sandbox) to run those executable and see if any red flag is raised there. Virus Total also runs it in its sandbox and provide details to its users. Submitting there has much better affect than submitting it to an individual vendors b/c this makes the file available to a wider audience faster.

That being said, if the malware is targeting large corporate or critical infrastructure or large masses in critical amount, they would all be interested in analyzing that if you can convince them that's the case. If the malware is targeting regular users and not affecting large masses, there is not much incentive for vendors to analyze files on request (many will likely be false-positive) without getting paid for it.

Your best bet would to convince an independent/freelance security researcher. You can access them many of them through Twitter or their blogs. If you can provide some convincing details, they can decide to analyze it in more details for free as it is good material for their reputation and their blog. But, I'm sure, they will also run it through a smell test, before fully diving into it. Manual analysis is not cheap (i.e. takes time).

See here for some relevant details

Where can I find an engineer who can examine an exe and verify its legitimacy?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .