[EvilNerd]

Those days I'm experimenting with avast in my virtual machine.
Avast was always been a major headheache for me, for his sandbox warning dialog that popup always
when find a new file and ofter scare the customer that can choose to negate the execution of the program
or find it and erase (or reformat the pc,or make a restore  😵) and my experiments are focused about to find
a way to avoid it or reduce the damage.

Those experiment were becoming  a drama when avast, suddenly and without a warning seized my freshly compiled program (final release) and send it to his headquarters for analysis.  😭

The dialog says something like "you tried to run a very unusual file, we send it to our labs for analysis" (didn't screecap the original dialog).
Weird, because I've run the same program in the same VM and only got the usual sandbox warning dialog. (I have closed and restored the virtual machine between the two tests)

When I try to run the same program later. I got this dialog.


Fortunately my program SURVIVED the dreaded avast lab test, avoiding to be flagged as malware ! 🤗

Experimenting about WHAT caused this anomalous detection I've found another anomaly:
the usual sandbox warning dialogs that avast shows when running a new program have gradually stopped appearing.
Now all programs can run without sandbox check. Even the totally new ones.

I've erased the virtual machine where avast was installed and reinstall a totally new issue of avast: same behaviour.

Does avast have the capability to detect when is used in a sort of "malware test lab" and stop his functionality ?
Does someone have some experience with this pesky antivirus and his crazy behaviour ?

[CyberStrike]

Why in the world would you test while the machine is on the internet? Yes AVs like to check back home I know that but I personally would work on a VM no AV no sharing nothing for compiling. And during testing run it through a proxy for all protocols If you MUST have internet run with through a proxy that blocks domains associated with Avast. I'd say run wireshark and block the domains one by one. You should whitelist or have your programs in a folder that has exceptions during compilation. This is poor opsec hope you learn from it.

Edit: I don't think it just says "Malware testing lab" and gives up. Think about it that is a goldmine for AVAST why stop that? I'd rather have it stop alerting you and let you think everything is fine and analyze your samples.

[EvilNerd]

Why in the world would you test while the machine is on the internet? Yes AVs like to check back home I know that but I personally would work on a VM no AV no sharing nothing for compiling.

Other told me the same: run the test disconnected from internet. I was used to do so, unfortunately realized years ago that the detection is totally different between online and offline scanning.

A malware that is undetected offline often will be detected when run online.

And during testing run it through a proxy for all protocols If you MUST have internet run with through a proxy that blocks domains associated with Avast. I'd say run wireshark and block the domains one by one. You should whitelist or have your programs in a folder that has exceptions during compilation.  

Indeed I'm very interested to do something similar: network filtering for blocking automatic submission.
the problem is : how block the submission without hampering the detection ?

This is poor opsec hope you learn from it.

😯  I'm paranoid AF about opsec. The test on VM are run gradually, using a lot of dummy, garbage code.
The objective is to test methods sharing as little code as possible.
The production machine don't even run antivirus.

If someone is interested about this argument (test the code avoiding the antivirus to steal it, avoiding the avast sandbox) drop me a line  🎉

[CyberStrike]

Other told me the same: run the test disconnected from internet. I was used to do so, unfortunately realized years ago that the detection is totally different between online and offline scanning.

A malware that is undetected offline often will be detected when run online.

Indeed I'm very interested to do something similar: network filtering for blocking automatic submission.
the problem is : how block the submission without hampering the detection ?
😯  I'm paranoid AF about opsec. The test on VM are run gradually, using a lot of dummy, garbage code.
The objective is to test methods sharing as little code as possible.
The production machine don't even run antivirus.

If someone is interested about this argument (test the code avoiding the antivirus to steal it, avoiding the avast sandbox) drop me a line  🎉

Unfortunately this is very true AV's now need to have internet to call back home to check hashes, certificate validity and all that jazz. I think that the real trick would be to setup a VM with various AV products (one at a time) and proceed to see where it is submitting files. I would grab up some samples and do a few changes just enough to make it a bit unique, from there I would see what is being connected to and what protocols are in play. From there you can setup a proxy where it will block domains/protocols.

As an example check out the following :

https://docs.netgate.com/pfsense/en/late..._Extension

You will want to allow somethings as not to castrate the AV so detections are somewhat real world, but not where it uploads it's tough because AV companies are pretty shady