Ghosts in the Endpoint[html]
We would like to introduce the first of our “Ghosts in the Endpoint”
series, a report prepared by FireEye Labs that documents malicious
software not being detected in the wild by traditional signature-based detections.
In this study, all the families identified are samples from
VirusTotal (VT) with zero detections, but detected as malicious by our
Multi-Vector Virtual Execution (MVX) Engine. We also added a few
samples with very low detection rates (VT <=3) but with interesting
bypass techniques.
Our goal is to share indicators that help the AV community and
others improve their detection coverage.
Scope
- So far, only samples found in VT with the following file types
were included in this study: - Win32 binaries
- Office
documents (including Open XML format) - RTF documents
- Hangul Word Processor (HWP)[1] documents
The study includes samples submitted to VT in 2015 that were still
found undetected or with minimal detection rates as of January 2016
(see VT detection Tables in the Appendix).
