Russian service online to check the detection of malware

One thing of concern to the creators/distributors of malware is whether the virus is able to detect their binary and thus ruin their economic plans.

One possible way to test the detection capability of these binary antivirus is up to sites like VirusTotal, which to date, using 41 different antivirus engines.The big problem is that these sites often work in collaboration with antivirus companies, providing feedback on the samples. Therefore, although at the time of analysis it's possible that only a few of the antivirus (or none at worst) are able to identify the evil qualities of the binary in question, most likely the detection rate will increase to full speed in a short space of time.

This has opened a niche business, and in May this year appeared posts in various forums in announcing a new service (then free) to analyze the level of detection without alerting the antivirus houses. VirTest born.

Currently this page, of Russian origin (although it has its English version) offers 26 different antivirus engines, with the possibility to choose what you want them to be used to check the sample. Here you can see a list of antivirus engines and their respective versions. On the website specified in detail how often is updated each virus, depending on each company's policy to continue to publish new signatures.

The analysis of binary display a table that is why antivirus recognizes the malicious code and which not. Clicking the link to the file name will open a box where we can see information about the file type and size, different hashes of the same information on its structure (if an .exe), among others.

If we then click on the link "See file" will display the file itself a fragment of 1000 bytes in size.

However, the added feature that makes this service a differentiator with respect to similar services is the ability to analyze a type crimeware Exploit Pack, giving the url that is hosted.

FAQ In the words of the service, don't really check the script, but the resulting code will be received by the different types of browsers. The tests are performed with Firefox, IE6, IE7, IE8, Opera and Chrome.

Clicking on any of the links we can see the box before extending the analysis information.

To perform one of these tests is necessary to create an account and have cash in it, as it has become a paid service with the following prices:

The payment of contributions is done exclusively via WebMoney. There is at least one other similar service is free and is currently in beta enuentra. We suppose that soon will be a toll too.

In summary, further evidence that not only the exploitation of malware generates profits but also moves parallel money on services to this industry. And in some cases like the present one, have to see if you can consider this service as a criminal act or not.

Related information
Software as a Service on the malware industry
Creating Online PoisonIvy based polymorphic malwar...
Panorama actual del negocio originado por crimewar...
Prices of Russian crimeware. Part 2

Ernesto Martín
Malware Research
Pistus Malware Intelligence