Discussion:
[clamav-users] Question about sending sample process
Luca Moscato
2018-11-06 09:46:09 UTC
Permalink
Hi everyone, one of our customers notify us that the AV we use (clamav
of course) does not detect some of malware downloadable from das malwerk
usued for testing.

Pretty strange situation, so we decided to download all malwares from
that site and send as a sample using command line interface

[***@amazon-ami:~]$ clamsubmit -n
/home/luca/malware/d77aca7d-f9f1-11e7-b482-80e65024849a.file -N luca -e
***@funambol.com
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a
href="http://www.clamav.net/sendmalware.cgi">here</a>.</p>
</body></html>
[***@amazon-ami:~]$

Question 1 - Is this process correct to send samples?

Question 2 - How much time is required to validate a sample and get the
A/V db updated? Days? Months?

Some notes:

- I'm using Amazon linux and clamav version available in amz linux repo,
db should be updated with freshclam

[***@amazon-ami:~]$ sudo freshclam
ClamAV update process started at Tue Nov  6 09:36:41 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.4 Recommended version: 0.100.2
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60,
builder: sigmgr)
daily.cld is up to date (version: 25095, sigs: 2143057, f-level: 63,
builder: neo)
bytecode.cld is up to date (version: 327, sigs: 91, f-level: 63,
builder: neo)

- I have all links and script (see attach) to quick download all stuff
from das_malwerk

- Actually a scan of all the stuff retrieved from that website have this
results while I expect to have a 100%

----------- SCAN SUMMARY -----------
Known viruses: 6702413
Engine version: 0.99.4
Scanned directories: 1
Scanned files: 1488
Infected files: 964
Data scanned: 1125.26 MB
Data read: 1195.11 MB (ratio 0.94:1)
Time: 361.283 sec (6 m 1 s)


Thanks and have a nice day

Luca
Arnaud Jacques
2018-11-06 10:00:51 UTC
Permalink
Hello Luca,

If I remember well, clamsubmit only works since versions 0.100.x of
ClamAV. It seems you are still using version 0.99.4.
Post by Luca Moscato
Question 1 - Is this process correct to send samples?
Yes it it.
Post by Luca Moscato
Question 2 - How much time is required to validate a sample and get
the A/V db updated? Days? Months?
Depending of many things on ClamAV team side, it can take just a few
hours, or days, or ... never.
Post by Luca Moscato
- Actually a scan of all the stuff retrieved from that website have
this results while I expect to have a 100%
If you expect 100% detection, please use at least the last version of
ClamAV.
And some 3rd party signatures can help to get full detection :
https://sanesecurity.com
http://ow.ly/LqfdL
--
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.44.39.76.46
E-mail : ***@securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom

Securiteinfo.com
La Sécurité Informatique - La Sécurité des Informations.
266, rue de Villers
60123 Bonneuil en Valois

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Al Varnell
2018-11-06 10:03:57 UTC
Permalink
Luca

It's possible that some of the failure to detect is due to your using an outdated version of ClamAV. Some signature only work with more recent versions. You should probably focus on upgrading before submitting any undetected samples.

-Al-
ClamXAV User
Hi everyone, one of our customers notify us that the AV we use (clamav of course) does not detect some of malware downloadable from das malwerk usued for testing.
Pretty strange situation, so we decided to download all malwares from that site and send as a sample using command line interface
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.clamav.net/sendmalware.cgi <http://www.clamav.net/sendmalware.cgi>">here</a>.</p>
</body></html>
Question 1 - Is this process correct to send samples?
Question 2 - How much time is required to validate a sample and get the A/V db updated? Days? Months?
- I'm using Amazon linux and clamav version available in amz linux repo, db should be updated with freshclam
ClamAV update process started at Tue Nov 6 09:36:41 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.4 Recommended version: 0.100.2
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav <http://www.clamav.net/documents/upgrading-clamav>
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
daily.cld is up to date (version: 25095, sigs: 2143057, f-level: 63, builder: neo)
bytecode.cld is up to date (version: 327, sigs: 91, f-level: 63, builder: neo)
- I have all links and script (see attach) to quick download all stuff from das_malwerk
- Actually a scan of all the stuff retrieved from that website have this results while I expect to have a 100%
----------- SCAN SUMMARY -----------
Known viruses: 6702413
Engine version: 0.99.4
Scanned directories: 1
Scanned files: 1488
Infected files: 964
Data scanned: 1125.26 MB
Data read: 1195.11 MB (ratio 0.94:1)
Time: 361.283 sec (6 m 1 s)
Thanks and have a nice day
Luca
Joel Esler (jesler)
2018-11-06 14:27:10 UTC
Permalink
On Nov 6, 2018, at 4:46 AM, Luca Moscato <***@funambol.com<mailto:***@funambol.com>> wrote:

Question 1 - Is this process correct to send samples?


Please update the version of clamsubmit you are using. You are several versions behind.
Luca Moscato
2018-11-06 16:10:46 UTC
Permalink
Thanks to everyone, by adding some extra signature the found rate has
increased, a few, but has increased and this is a good news.

Luca
Post by Luca Moscato
Question 1 - Is this process correct to send samples?
Please update the version of clamsubmit you are using.  You are
several versions behind.
_______________________________________________
clamav-users mailing list
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
Micah Snyder (micasnyd)
2018-11-06 20:38:30 UTC
Permalink
Thanks Luca for investigating the false negative reports and submitting them to our malware research team. These reports really help, even if you don't necessarily get feedback on the reports.

Kind regards,
Micah

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Nov 6, 2018, at 11:10 AM, Luca Moscato <***@funambol.com<mailto:***@funambol.com>> wrote:


Thanks to everyone, by adding some extra signature the found rate has increased, a few, but has increased and this is a good news.

Luca

Il 06/11/18 15:27, Joel Esler (jesler) ha scritto:


On Nov 6, 2018, at 4:46 AM, Luca Moscato <***@funambol.com<mailto:***@funambol.com>> wrote:

Question 1 - Is this process correct to send samples?


Please update the version of clamsubmit you are using. You are several versions behind.



_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net<mailto:clamav-***@lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net<mailto:clamav-***@lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Continue reading on narkive:
Loading...