VirusTotal += malwares.com URL checker

Many security industry actors build solutions that lie in the perimeter of networks, inspecting traffic and discriminating potentially malicious content. One of these solutions is SIMBA from Saint Security (others include FireEye, Fidelis XPS, Damballa, etc.).

In inspecting traffic, these solutions have a privileged position to perform correlations to discover and characterize malicious patterns, this is what allows these companies to discover thousands of malicious URLs and files every day. Saint Security has made part of their discriminatory logic available at malwares.com:

As a cloud-based malicious codes database system, malwares.com is a one-stop service to collect, analyze and detect various malicious codes or malwares such as Trojans, Viruses, Worms so that customers or end-users can make proper security policies to take countermeasures against security threats.

Today we are excited to announce that malwares.com has been integrated in VirusTotal as a URL checker and as of today URL scans will be enriched with their dataset of malicious verdicts. This inclusion is very interesting as it covers much of the threat landscape seen in South Korea, a clear example of this is the following report:
https://www.virustotal.com/en/url/3625ed7252e98152ad781b3deea92038bc1d416c343f8b7bfe2a3ec8ca5b3727/analysis/

Welcome on board and thanks for joining us!

Read More

VirusTotal += StopBadware

StopBadware is a nonprofit anti-malware organization based in Cambridge, Massachusetts. Our work makes the Web safer through the prevention, mitigation, and remediation of badware websites. We protect people and organizations from becoming victims of viruses, spyware, scareware, and other badware.

This is the way the StopBadware team describes itself, a pretty awesome initiative that has managed to bring together many partners. From now onward VirusTotal users will also be able to take advantage of their URL verdicts.

StopBadware numbers are very impressive, since their launch they have managed to:

• inform over 700,000 website owners about how to remediate their compromised sites and prevent future attack
• serve more than 10 million Google and Firefox users with content about how to mitigate their risk of badware infection
• help de-blacklist over 100,000 websites flagged by our data providers for badware
• enlist more than 50 web hosting providers from 22 countries (and counting) in the We Stop Badware™ Web Host program, which helps those providers respond more quickly and effectively to reports of badware on their networks

Without doubt, this integration will bring great value to VirusTotal, thank you StopBadware!

Read More

VirusTotal += Virus Tracker

Just after Kaspersky joining VirusTotal's aggregate URL scanner, we are excited to announce that Virus Tracker is also becoming part of our family:

https://www.virustotal.com/en/url/82ddbb7eea25e7ce2ca13aed44cac009d9ff6c463e763d22b8b2043f20bd8a52/analysis/1367576071/

Virus Tracker is a service whose mission:

is to provide detailed infection statistics, C&C information and an automatically updated domain blocklist of various botnets to the security community.

The site is non-profit and focuses on banking trojans and financial malware, some of the botnets they track are: multibanker, sinowal, tinybanker, urlzone, zeus, ramnit, etc. This is fantastic news for the average end-user, since they will have a better view of the most perilous threats directly targeting their money.

Yet another URL scanner, one more and we will be in the forties, thank you Virus Tracker team!

Read More

VirusTotal.url_scanners.extend(Quttera, ESET)

We are pleased to announce that we are including two new URL scanners in VirusTotal: Quttera and ESET. At the same time, we are also updating Trend Micro's and Antiy-AVL's web checkers, the changes should improve their detection rates, enhancing the overall aggregate detection capability of VirusTotal's URL scanning engine.

Quttera describes its technology as follows:

WIS is a BETA version of a cloud based application that utilizes Quttera exploit detection technology. This online URL scanner investigates URLs in order to detect suspicious scripts, malicious media and any other web security threats hidden into legitimate content and located on web sites. 

As to ESET, its URL scanner is usually embedded in their antivirus software, providing a holistic solution:

At ESET, we are dedicated to developing high-performing security solutions for home users and corporate customers, detecting and disabling all known and emerging forms of malware.

We are really excited to announce these changes since we have just reached 37 URL scanners, even though not all of them always show up due to timeout issues. We will soon catch up with the number of file scanners. If your company/team develops a link checker or maintains a malicious URL dataset do not hesitate to contact us, we will be more than happy to integrate your solution/dataset.

Read More

VirusTotal += ADMINUSLabs

Continuing the trend of engine inclusions we have just added ADMINUSLabs as a new URL scanner. In words of ADMINUSLabs itself:

ADMINUSLABS has built an incredibly robust and comprehensive binaries and malware collection and analysis set of tools, enabling organizations of all sizes to leverage the data analyzed and threats monitored to build better defense system. With clients and partners in every continent, ADMINUSLABS solutions offer industry leading technology, flexibility, cost effectiveness, and service levels.

ADMINUSLabs has shared its malicious URL dataset with VirusTotal, from now on, whenever a user submits a URL to VirusTotal for scanning it will also get checked against ADMINUSLabs' dataset and flagged as malicious if present in it. This is an example of a report with one such detection:

https://www.virustotal.com/url/0048c271f6c90bc6959c0eb91ed139692a1ec0f0f4b3328a9ad09baad010c7c2/analysis/1354276484/

ADMINUSLabs' dataset is very large and gets updated several times per day with thousands of new URLs, this is an excellent addition, many thanks and welcome on board!

Read More