MRnutty200 Posted March 10 Share Posted March 10 hello i've been using virus total for a while to spot rats and it works pretty well but when i use kapersky threat intelligence it doesnt detect the rat and says its safe https://www.virustotal.com/gui/file/a1d2e9ae54bb0227f48f80afdae9b16fefa2f989a6bec0ae3415bb05d5e72593/relations https://opentip.kaspersky.com/A1D2E9AE54BB0227F48F80AFDAE9B16FEFA2F989A6BEC0AE3415BB05D5E72593/results?tab=upload if you wonder how i know the dll its a rat is because. 1.-comes from a not repuateble website 2.-its a crack 3.-URLDownloadToFileW URLDownloadToFileW is normal to find in dlls that are rats Link to comment Share on other sites More sharing options...
Flood and Flood's wife Posted March 10 Share Posted March 10 (edited) 53 minutes ago, MRnutty200 said: hello i've been using virus total for a while to spot rats and it works pretty well but when i use kapersky threat intelligence it doesnt detect the rat and says its safe Hello @MRnutty200, Welcome back! Follow this Kaspersky guide - at *Step 3*: Kaspersky application blocks my website or application. What should I do? Please share the outcome with the Community, when it's available. *Also* is (your) installed Kaspersky software really from Kaspersky's Business range: Kaspersky Scan Engine? Thank you🙏 Flood🐳+🐋 Edited March 10 by Flood and Flood's wife question about users' installed software Link to comment Share on other sites More sharing options...
Berny Posted March 10 Share Posted March 10 @MRnutty200 3 hours ago, MRnutty200 said: when i use kapersky threat intelligence it doesn't detect the rat and says its safe Concerning Remote Access Trojans (RAT) personally i prefer this approach : → How to secure Router & Wi-Fi networks Also → "EnDisable external management of system services" Spoiler 2 Link to comment Share on other sites More sharing options...
harlan4096 Posted March 10 Share Posted March 10 I sent 9 hours ago that file to K. analysts, and this is their final verdict: Quote Hello, No malicious software was found in the attached file. Best regards, Malware Analyst 39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names Don't trust neither all the VT detections nor the comments there, They tend sometimes to be wrong or false positives... 3 Link to comment Share on other sites More sharing options...
MRnutty200 Posted March 10 Author Share Posted March 10 (edited) 47 minutes ago, harlan4096 said: I sent 9 hours ago that file to K. analysts, and this is their final verdict: Don't trust neither all the VT detections nor the comments there, They tend sometimes to be wrong or false positives... also why does kapersky say that this program called exloader is safe:https://opentip.kaspersky.com/7AD99C1905E0C0CA46BD97650A50645592A6006F05062AA4580198C41C6491A1/results/suspiciousEvents its a well known keylogger and has cause a load of contreversy on reddit. its a installer(setup) . the program in the installer is probably the keylogger or maybe the loader and if you wonder why i keep replying whit more programs its yust cuzz something feels off about kapersky threat intelligence portal like really off its eather 100% accurate and doesnt give false positives or its detecting programs and dll's as safe Edited March 10 by MRnutty200 Link to comment Share on other sites More sharing options...
Flood and Flood's wife Posted March 10 Share Posted March 10 24 minutes ago, MRnutty200 said: also why does kapersky say that this program called exloader is safe:its a well known keylogger and has cause a load of contreversy on reddit. its a installer(setup) . the program in the installer is probably the keylogger or maybe the loader and if you wonder why i keep replying whit more programs its yust cuzz something feels off about kapersky threat intelligence portal like really off its eather 100% accurate and doesnt give false positives or its detecting programs and dll's as safe Hello @MRnutty200, Thank you for posting back! IF *you* have doubts about the automated tool -always submit a request direct to the Virus Lab experts using the Kaspersky guide provided in our last reply. Thank you🙏 Flood🐳+🐋 Link to comment Share on other sites More sharing options...
harlan4096 Posted March 11 Share Posted March 11 Hum about that other program, to be well known, any av firm detects it at VT 🤔: In K. OPENTIP is Not Categorized, probably because haven't analyzed yet in depth... can You provide the installer link to download? 1 Link to comment Share on other sites More sharing options...
MRnutty200 Posted March 11 Author Share Posted March 11 35 minutes ago, harlan4096 said: Hum about that other program, to be well known, any av firm detects it at VT 🤔: In K. OPENTIP is Not Categorized, probably because haven't analyzed yet in depth... can You provide the installer link to download? the installer is not malicious but the EXE that it downloads is a keylogger Mod Note: link removed. Link to comment Share on other sites More sharing options...
harlan4096 Posted March 11 Share Posted March 11 Thanks, I will try in a VM... 1 Link to comment Share on other sites More sharing options...
MRnutty200 Posted March 11 Author Share Posted March 11 1 minute ago, harlan4096 said: Thanks, I will try in a VM... also is kapersky threat intelligence good for scanning dlls? https://opentip.kaspersky.com/BCD7A153C91DC7932937A16E9F041ABE310D1304BFFF5523198F867A9C5689BC/results?tab=upload it doesnt really give me aloot of info even whit a full scan 1 Link to comment Share on other sites More sharing options...
MRnutty200 Posted March 12 Author Share Posted March 12 20 hours ago, harlan4096 said: Thanks, I will try in a VM... apart from it being a keylogger what else does it have? Link to comment Share on other sites More sharing options...
harlan4096 Posted March 13 Share Posted March 13 Check the pics taken in the test I've done in my VM: https://mega.nz/folder/h8QVhR4T#VmUbg7B1Uu9JJ1oKIZmyjA There is no infection there apparently, the only thing I saw is that it install Opera browser and set it in Windows AuntoRuns... none of the Second Opinion Scanners found anything suspicious... 1 Link to comment Share on other sites More sharing options...
MRnutty200 Posted March 14 Author Share Posted March 14 15 hours ago, harlan4096 said: Check the pics taken in the test I've done in my VM: https://mega.nz/folder/h8QVhR4T#VmUbg7B1Uu9JJ1oKIZmyjA There is no infection there apparently, the only thing I saw is that it install Opera browser and set it in Windows AuntoRuns... none of the Second Opinion Scanners found anything suspicious... im not shure it its safe but from what i heard its that it use to steal people passwords and they also have dlls for stuff and they never really checked the dlls and made shure that they where safe thats why it gained a load of contreversy. but the conclusion is that its not malicious? im super confused? Link to comment Share on other sites More sharing options...
harlan4096 Posted March 14 Share Posted March 14 As You can see I installed that tool, but in the end I did not install any game since You have to pay for it, so... You can see just installing the tool any scanner of different security firms found nothing suspicion, but it is true that would not mean not malicious but... 1 Link to comment Share on other sites More sharing options...
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now