+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: avcheck.net possibly distributing files (/showthread.php?tid=6121220)
avcheck.net possibly distributing files - .fn. - Nov 12, 2020
i am currently almost 42 hours awake so excuse me if there is a simple explanation that i missed but basically i compiled a bin of my project, scanned it on avcheck and a short time afterwards a bot appeared in my panel, as far as I'm aware avcheck is scantime only so no reason for the file to be ran
https://avcheck.net/id/duseJE37SbOy original scan
https://avcheck.net/id/1cTFjJjvLs9O same file an hour later with one extra detection from Emsisoft Anti-Malware (check the part of the hash you can see)
bot ip from russia, running windows 7 professional 64bit
note: antiscan.me (posted in many threads as proof of fud) uses avcheck api
RE: avcheck.net possibly distributing files - R A Z - Nov 12, 2020
the scans are normal because the detection names are same "Gen:Variant.Zusy.328313", in my opinion on the first scan Emsisoft Anti-Malware was on old version and on the new scan the engine was updated .
RE: avcheck.net possibly distributing files - Jacque Fresco - Nov 12, 2020
probably what RAZ said. curious about the bot. maybe a leak appeared making the scanner upload data to the cloud. but i highly doubt they scan with internet turned on. i dont use it so idk.
you could write up a simple script specifically uploading data to a server once online. if you find data on that server but you only uploaded it to avcheck and its not your own machine silently distributing then.. lol
RE: avcheck.net possibly distributing files - Cyber Coder - Nov 12, 2020
it is possible to distribute unintentionally like my scanner cyberscan.org did in the 1st week till i figure out what was happening .
How i was handling it . All options to distribute OFF , internet OFF all the time except when they updated for few mins, turned out avast was still screwing me over in that little window time.
How i fixed it ? Made sure to always take a snapshot after update and revert back to that snapshot before updating again so that avs will never get the file they scanned before internet gets on.
RE: avcheck.net possibly distributing files - Jacque Fresco - Nov 13, 2020
(Nov 12, 2020 11:34 PM)Cyber Coder Wrote: How i fixed it ? Made sure to always take a snapshot after update and revert back to that snapshot before updating again so that avs will never get the file they scanned before internet gets on.
Clever, these AV's seem to actually store their previous unknown files to have them uploaded once internet is back on. But by reverting right back to after the update, is defeating this technic
RE: avcheck.net possibly distributing files - YAK_CODER - Nov 16, 2020
No sir
you are wrong
the case is that major av that give Gen:Variant.Zusy.328313 is Bitdefender Total Security 2020
Bitdefender share its signature database with many av
the issue that emsi soft update this signature on 1 hour or 2 relay
about Gen: detction family
its basic shit play with file resouce like icons or other resources will remove it
RE: avcheck.net possibly distributing files - .fn. - Nov 16, 2020
(Nov 16, 2020 08:57 AM)YAK_CODER Wrote: No sir
you are wrong
the case is that major av that give Gen:Variant.Zusy.328313 is Bitdefender Total Security 2020
Bitdefender share its signature database with many av
the issue that emsi soft update this signature on 1 hour or 2 relay
about Gen: detction family
its basic shit play with file resouce like icons or other resources will remove it
detection is not the issue, the issue is my bin being executed on an apparent no distributing scantime check
RE: avcheck.net possibly distributing files - Jacque Fresco - Nov 16, 2020
(Nov 16, 2020 10:02 AM).fn. Wrote: detection is not the issue, the issue is my bin being executed on an apparent no distributing scantime check
so will you create a small dedicated bin that only sends a ping to a certain server if executed? it would help figuring out if something is up with avcheck.net
RE: avcheck.net possibly distributing files - .fn. - Nov 16, 2020
(Nov 16, 2020 11:11 AM)Jacque Fresco Wrote: so will you create a small dedicated bin that only sends a ping to a certain server if executed? it would help figuring out if something is up with avcheck.net
that is literally what has happened and why i created this thread
RE: avcheck.net possibly distributing files - stowalone - Jan 10, 2021
a friend told me about yoru crypter, how do i go about getting it, i need asap... kindly get back to me, thanks for your time