Additional Crispiness on the MacOS box of apples sandbox

In November 2015 we first released our MacOS sandbox. We now have an incremental feature improvements live on our site to help our users get further behavioral information from samples scanned with VirusTotal

Several improvements visible to users are:

• Sandbox updated to OSX 10.11 El Capitan in sandbox.  We have a High sierra update planned for later this year. 
• Detailed HTML analysis report is now available. 
• Screenshots of the software under analysis to provide more contextual information:
• Show screenshots of what a user would see
• Help determine if the sample is waiting for user input
• Network traffic reports updated
• Country Detection
• Timestamps on file operations,  to help show the sequence of events.
• Process tree is shown if there is more than one level of processes

To view the detailed behavior report, click on the behavior tab, then select the Box of Apples sandbox, then click on the detailed report link

Click on the detailed behavior report. 

Some Samples that might be interesting, that contain the new features:
ec7241a6009f1fff38b481d8b4fd6efede4cc2f9d8ee20d9ca2b4ff66d656171
3b196c1c1a64aca81dec5a5143b3f2faaadcc4034b343f46f23348f34a2ef205
694c23b548249056bf90b2b2c252a8c9abfae4aeb611476cbdaa8dc112f79d8f

Screenshots and File operations

DNS, IP Traffic and Behavior tags

This is part of the Multi-Sandbox project.    We’ll continue to improve our own and 3rd party sandbox providers that wish to integrate sandboxes into VirusTotal.

If you find any issues, or have feature requests, please don’t hesitate to reach out to us by emailing  contact@virustotal.com

Read More

VirusTotal Uploader for OS X

VirusTotal Uploader is a popular utility in the tool-set of many malware fighters, it eases the task of submitting files to VirusTotal using Windows operating systems by just performing a right click on any file and selecting the pertinent option from the context menu.

Over the years the Windows Uploader evolved, being able to also quickly scan the image files of running processes, trigger scans of remote URL content before saving it to disk, etc. Even some community members produced similar utilities, many of which outperform our very own software, an example of this is Phrozensoft's VirusTotal uploader. That is the magic of building a community of passionate researchers, they will use your APIs in order to produce better tools that will benefit end-users world-wide.

Today we are proud to announce a new VirusTotal Uploader for OS X. It is available for download on our Desktop Applications page. Internally it uses our  public API to schedule uploads of files, with the exact same limitations that any public API user would experience.

Some of it's feature are:

• Drag and drop a file to the VirusTotal Uploader in order to scan it with over 50 antivirus solutions.
• Drag and drop a folder to the VirusTotal Uploader and schedule the analysis of its content.
• Drag and drop a Mac application  to the VirusTotal Uploader.
• Allow you to "Open With" in finder the VirusTotal Uploader to scan a file.

Hopefully this will lead to VirusTotal receiving more Mac applications, diving deeper into an increasingly targeted OS by attackers and allowing antivirus companies and researchers making use of VirusTotal's back-end to build stronger defenses against these threats.

It has been tested on OS X 10.8 and 10.9.  Any bug reports, feedback or feature requests are welcome. 

Read More