[justalemon]

Hi there!

These past days had a few issues where I checked a file which wasn't previously detected by WD on Avcheck, and afterwards when I try to copy the file again into the VM with WD, it gets detected. I was wondering myself if AVCheck distributes the file checked. What about antiscan.me? Same happened to me with checkzilla.io.

What do you think about this? Did this happened to you in the past? Do you think they distribute the files against what they confirm at their sites?

Thanks in advance for your time and opinions.
Cheers ✌

[NotKover]

The issue with most of those scanners is the operators dont keep all the scanners up to date

[justalemon]

The issue with most of those scanners is the operators dont keep all the scanners up to date

Yeah, but anyhow, it shouldn't get your file detected because of that right? I mean, why would WD detect it after scanning it there? It's crazy XD

[Athr]

Yeah, but anyhow, it shouldn't get your file detected because of that right? I mean, why would WD detect it after scanning it there? It's crazy XD

Can you try disabling internet on the VM and rescan it?
I have read on the forums that WD has cloud detection.

[Jack Herrer]

The Best Way is Don't Scan Anywhere for a week or month, and check again.

---

Yeah, but anyhow, it shouldn't get your file detected because of that right? I mean, why would WD detect it after scanning it there? It's crazy XD

Sometimes it's detecting Clean File with No Code Inside, WD Is Broken, Microsoft is not good on this work.

[Frost Crypt]

i can confirm avcheck is sometimes slow of updating wd database, tested in my vm and it was showing detection while it was clean on avcheck, no it wasn't cloud detection.
also when i refuded my stub for avast and forgot to release the update that day and released it the next day, avast was seeing the stub again while nobody ever used that stub so what can i say...is hard to live with these websites but harder to live without.

[NotKover]

Yeah, but anyhow, it shouldn't get your file detected because of that right? I mean, why would WD detect it after scanning it there? It's crazy XD

because the scanner is out dated

[nulluser123]

Looking for a dynamic scanner similar to dyncheck - I know checkzilla exists but that stuff sucks, doesn't show detections the same dyncheck once did. Price doesnt matter. Does anyone know of any?

[Ph4n70M Phr34K]

My opinion is that scanning websites such as avcheck, antiscan, checkzilla are never accurate and it is always better to just do manual check in virtual environment, it takes time but at least you have full control and you can be sure that your file will not be distributed.

[nulluser123]

Yes.

Adding a bit to this;

There is a common misconception in what people need, or truly need really. Especially when it comes to a crypter.
You test against what you're up against. Simple. There are ESET, Kaspersky, Avast etc licenses for dirt cheap, AmazingLicense is one to name, in which they can be installed on virtual machines for security research and manual scanning. Remember to roll your snapshot back in your VM, and make sure sharing of samples is OFF.

The big 5, ESET, Kaspersky, Avast, AVG and WD should handle the majority portion of home targets.
For corporate/commercial (depending on spearfishing target by threat actor), WebRoot Enterprise, Comodo, HP Wolf ENTERPRISE(not to be confused with HP Wolf freeware with modern workstations) etc. class which are, imo, the best in the business require specialty tools to avoid dynamic and tripwire detections as well as SOCKS hollowing functionality for internal corporate VPNs.

The problem is that when you're pushing out, say, 10-100 stubs, polymorphically generated, and want to test the % of FUD of the stubs, you don't have the time to load up VMs and scan every binary manually. An automated service that provides API interface is very useful to have. Dyncheck used to work great, now its gone. Any alternatives?

[SIM-4982069]

The problem is that when you're pushing out, say, 10-100 stubs, polymorphically generated, and want to test the % of FUD of the stubs, you don't have the time to load up VMs and scan every binary manually. An automated service that provides API interface is very useful to have. Dyncheck used to work great, now its gone. Any alternatives?

Try kleenscan

[justalemon]

Try kleenscan

Yeah, I have tested it already, but results aren't very accurate always either. I preffer antiscan for the moment, but I appreciate very much the suggestion. Thanks!

[nulluser123]

Yeah, I have tested it already, but results aren't very accurate always either. I preffer antiscan for the moment, but I appreciate very much the suggestion. Thanks!

Antiscan is just reselling avcheck!

[Capos666]

Looking for a dynamic scanner similar to dyncheck - I know checkzilla exists but that stuff sucks, doesn't show detections the same dyncheck once did. Price doesnt matter. Does anyone know of any?

Agree With You, i was Crypting some Files, Full FUD in AVCheck, as soon as i download the Files in My RDP Windows Defender Promp a new Virus scan and delete the payload, i think is test and error, Crypt Your file, change Stub, Icon, Assembly, Execution Delay and SO, install Mos common AV in RDP, uncheck all the "Send Sample" From AV and WD and just download your freshly Crypted payload, If some AV promps a virus, Then Refud everything, is a pain in the ass, Buy 100% Accurate, since You can Update the AV and WD Database and scan With Up to date software. AVCheck is not good enough, 100% Clean and WD inmediately detects.

[Frost Crypt]

Agree With You, i was Crypting some Files, Full FUD in AVCheck, as soon as i download the Files in My RDP Windows Defender Promp a new Virus scan and delete the payload, i think is test and error, Crypt Your file, change Stub, Icon, Assembly, Execution Delay and SO, install Mos common AV in RDP, uncheck all the "Send Sample" From AV and WD and just download your freshly Crypted payload, If some AV promps a virus, Then Refud everything, is a pain in the ass, Buy 100% Accurate, since You can Update the AV and WD Database and scan With Up to date software. AVCheck is not good enough, 100% Clean and WD inmediately detects.

checkzilla has internet off and your defender detection is cloud detection and requires internet so is not a bug, more like a limitation