A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #18603  by ColdCristal
 Wed Mar 20, 2013 9:20 am
AVASoft Antivirus Professional (new member of Disk Antivirus Professional family)
Code: Select all
SHA256:       de3d5a0132cfb24a7832ac4c4ff513a49914bea93e39ca1471183c9ad56fc429
SHA1:         fd232853bbd3114f07d0e1057da31ca442e8288c
MD5:          0d6b3c31468f2e9254bcb7c1f9752b97
File size:    539.5 KB ( 552448 bytes )
File name:    343F2DE99DB732750000343EF9AF3708.exe
VirusTotal: https://www.virustotal.com/en/file/de3d ... 363770398/
Attachments
pass: malware
(406.61 KiB) Downloaded 123 times
 #18617  by BachMinuetInG
 Thu Mar 21, 2013 1:40 am
Antivirus Security 2013

hxxp://tech-ava-soft.org/

Uses a great load of memory to 'scan'
Attachments
AntivirusSecurity2013.png
AntivirusSecurity2013.png (180.15 KiB) Viewed 799 times
Last edited by Xylitol on Thu Mar 21, 2013 3:18 am, edited 1 time in total. Reason: link obfuscation
 #18638  by Cody Johnston
 Thu Mar 21, 2013 9:28 pm
xwxproductions wrote:Antivirus Security 2013

hxxp://tech-ava-soft.org/

Uses a great load of memory to 'scan'
How is this malware? This is AV using ClamAV signatures and detecting only legit malware (and removing successfully). It is installed in %programfiles% just like any other legit software. I agree that it looks like a rogue and takes a great deal of resources during scanning, but I don't see how this could be classified as a rogue AV if it does what it claims and nothing else (even if it does not work as well as others). I had it pick up infections in my zip archives as well so it even scans zip files by default. It removed any infections found without asking for money or payment of any kind and can be removed completely using Add/Remove programs in Windows.

Connections point to: 207.57.106.31
which resolves to: hxxp://database.clamav.net (legit URL for ClamAV definition updates)

download size from hxxp://tech-ava-soft.org is ~53MB - hardly the size of a usual rogue dropper

I would not use it to protect my own PC but I would not say this is program has malicious intent. Please correct me if I am wrong.

EDIT: spelling
 #18644  by Xylitol
 Fri Mar 22, 2013 2:50 am
GUI, site, payement page remind alot the BestAV work.
anyway there is ethical issue if they use free ClamAV database to sell this.
TeamRocketOps wrote:download size from hxxp://tech-ava-soft.org is ~53MB - hardly the size of a usual rogue dropper
navashield was ~52 mb
edit: http://siri-urz.blogspot.fr/2013/03/ava ... virus.html
 #18647  by gied
 Fri Mar 22, 2013 7:02 am
The payment page used for Antivirus Security 2013 ( hxxps://tech-ava-soft.org:455/p/tn/ava/ ) shows boxshot of Avasoft Professional Antivirus. Maybe this Antivirus Security 2013 is used to reduce risk of payment shut down or to download for unhappy "customers" of APA. I do not see a way for many people to choose Antivirus security 2013 without looking info on Avasoft...
 #18650  by BachMinuetInG
 Fri Mar 22, 2013 12:18 pm
It's bascially half-legit.
Helps payment for FakeAV, but provides legit software. :o
The webpage also has a title 'AVASoft Professional Antivirus.
So Antivirus Security 2013 is only a 'cover-up'.
 #18677  by hx1997
 Sun Mar 24, 2013 8:34 am
AVASoft Antivirus Professional Downloader with valid digital sign :)
捕获2.png
捕获2.png (42.53 KiB) Viewed 639 times
Downloader 4/46
https://www.virustotal.com/file/3e9d6db ... 364112183/

Downloaded FakeAV 3/46
https://www.virustotal.com/en/file/8f93 ... 364113465/
Attachments
infected, this is the FakeAV it downloads
(398.5 KiB) Downloaded 107 times
infected, this is the downloader
(98.35 KiB) Downloaded 95 times
  • 1
  • 2
  • 3
  • 4
  • 5
  • 15