0

It is possible detecting threat by only with file information of a file like file's hash(md5,sha1,sha256, etc), file size, mime type, etc with ClamAV or Comodo AV for linux with shell command?

It is markable that here file is absent, only all information of that file is present.

Improve this question
2
  • 1
    File's hash may help assuming the file was seen before and its hash is already known, in which case if the hashes match you know it's that same known file.
    – user42178
    Feb 15, 2015 at 14:06
  • I need the exact thing what you have said. I need that I will give any hash of file and Clamav return me information that file is detected or not as threat if threat it will return with specific threat string.
    – Touhid
    Feb 15, 2015 at 14:12

3 Answers 3

Reset to default
2

My answer assumes you are asking this for a production system, and that you aren't asking this because you are starting to learn to be an anti-virus researcher.

Can you do it?

Yes, as other answers have stated there are many databases which list hashes, or can ID a threat by a hash.

but should that be your only line of defence?

However, there is a major caveat to this approach. Do you think that the file in question has come from an automated, or not very smart/persistent threat, or is this coming from a smart and persistent threat?

If you think the file has come from an automated campaign (like a massive phishing attack) then, yes, this approach might help.

Smart attackers will just keep trying

However, if you at all suspect that an intelligent human being is behind this attack, he will already be modifying his file so that it doesn't show up on a hash database. There are many ways of "poking" at an antivirus to see what it will allow. Smart attackers are experts at tricking AV software.

My advice to you

  • Regardless of the files origin, make sure you have a good antivirus running. Especially if your system has to take random files from the internet.
  • If your system MUST accept arbitrary files, make sure that you are validating them before accepting them. Check the size, extension, headers, whatever you can.
  • And also double check that those files can't be accessed in unintended ways.
  • If we are talking about a desktop system, ensure that you are doing everything you can to make sure people aren't going to funky websites or are clicking on suspicious links.
  • Make sure everyone has their firewall on (firewalls are harder to trick than AV)
  • Use an IDS (also harder to trick than AV)
  • If possible, try a host based IDS like http://www.ossec.net/ - this will scan your logs for issues too, and make life very hard on an attacker.
  • If you are on Redhat/Cent make sure to use their fine grain permissions system.

Don't use hash checking as a single line of defense. You will be lulled into a false sense of security

Improve this answer
2

Do a quick search on google and you find a lot of databases. OWASP offers one with a pretty easy interface: OWASP File Hash Repository. Simply send a DNS query with the Hash in MD5 oder SHA-1 prepended to hash.sapao.net (see "Testing the system"). If you want to run a large number of queries, I suggest you make a copy of their freely available Amazon AWS image and query local to reduce the load on their server(s).

This does not use ClamAV or Comodo AV, but you can use "dig" for the DNS query and simply "grep" the result.

Improve this answer
1

You can submit the hash to VirusTotal by selecting 'Search' and entering the hash. VirusTotal will return the status if it's seen the file before -- if it hasn't, you may be out of luck.

Improve this answer
1
  • They don't allow searching with hash programmatically. I am finding solution through antivirus without any restrictions and limits.
    – Touhid
    Feb 15, 2015 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.