#virus-total — Public Fediverse posts

RE: https://infosec.exchange/@hacks4pancakes/117077800430283622

#virustotal

A #Wordpress site belonging to an friend (I’m not the admin...) was successfully hacked using #wp2shell (17.07.2026; CVE-2026-63030 + CVE-2026-60137), just 5 days after the first exploit published (20.07.). Another 5 days later, the website was abused for SEO spamming and for hosting phishing…

If you haven't already, update your Wordpress (preferably yesterday…; >=v7.0.2 or >= 6.9.5) and also enable automatic updates for themes and plug-ins!

I found several PHP backdoors/webshells (see @abuse_ch Malware Bazaar and #VirusTotal (hashes below)). Interestingly, not every sample was detected by the #YARA rules from @cyb3rops and https://github.com/ruppde/yara_rules.

tl;dr #wp2shell is being actively exploited, patch immediately and enable automatic updates.

Hashes:
1093b4045b45a8498d146e31788c25769f992056c8ffc582b5d8c06598598966
05e3884a478d3bc8fd7285dabb74107422f1615d2d7f80df9b8438d4beb663da
bb9136494a546368e7c9b6252c2e1c5af9327c07947908a9ba6fdd78fb4bf4cf
1e7ca9074cc2eca8d366022629f665d9ffaa79e0621bb579bf5aabe681cb07e8
8ebaf3ba0be7b62269aaf333cfaf66c1dea6e8ee495a917691beb550b4bbf0ab
e3fb920aa70c7ad5c67b4d9b8e60954f5e0c1a07c0eba09505816b966f4d1a3c
165e94c87ef17389c8de25ba2a6c31b348e3c916dab89d0dd3708156414f3de5
b55cf5af8b57e9d56c69d00e023e2384c7eb184614c2a2a283062ebeaf4a26c6
a46230a1638b9b341d15a640ead1b885548c1d1e5a149657e8e315540a068be8
7918f29993383e579ef33bd0d8e766fd2ce047dce83bac51efb5fe17578b6cdf
ae9ee9db7c41e04c531298782b908766c769a899aa92df3f64f4a83baa77ad09

Grüne Häkchen bei VirusTotal bedeuten nicht, dass eine App garantiert sauber ist. Und rote Warnungen beweisen umgekehrt noch lange keine Malware.

Unser POC zeigt, wie fragwürdig manche Treffer zustande kommen: Bei einer APK reichte bereits das AndroidManifest.xml mit seinen Metadaten und Berechtigungen für Warnungen - ganz ohne ausführbaren Schadcode. Besonders absurd: Ein Scanner wollte die App nur freigeben, wenn sie im Google Play Store erscheint.

Scanner liefern lediglich Hinweise. Warum man genauer hinschauen sollte und weshalb der Play Store kein Vertrauensanker sein darf. 👇

https://www.kuketz-blog.de/wie-viel-verlass-ist-auf-malware-scans-fuer-android-apps/

#Android #VirusTotal #FDroid #OpenSource #ITSecurity

@IzzyOnDroid

Grüne Häkchen bei VirusTotal bedeuten nicht, dass eine App garantiert sauber ist. Und rote Warnungen beweisen umgekehrt noch lange keine Malware.

Unser POC zeigt, wie fragwürdig manche Treffer zustande kommen: Bei einer APK reichte bereits das AndroidManifest.xml mit seinen Metadaten und Berechtigungen für Warnungen - ganz ohne ausführbaren Schadcode. Besonders absurd: Ein Scanner wollte die App nur freigeben, wenn sie im Google Play Store erscheint.

Scanner liefern lediglich Hinweise. Warum man genauer hinschauen sollte und weshalb der Play Store kein Vertrauensanker sein darf. 👇

https://www.kuketz-blog.de/wie-viel-verlass-ist-auf-malware-scans-fuer-android-apps/

#Android #VirusTotal #FDroid #OpenSource #ITSecurity

@IzzyOnDroid

Я прошёл крипто-развод до конца и реверснул дрейнер: 12 доменов и не меньше $784k у ~70 жертв

Самое странное в этом дрейнере - его не видит ни один антивирус. VirusTotal: 0 из 91, а кошельки пустеют. Размотал всю схему: как жертва подписывает свой слив сама и куда уходят деньги.

https://habr.com/ru/articles/1050718/

#расследование #криптовалюты #фишинг #Binance #дрейнер #crypto_drainer #реверсинжиниринг #OSINT #VirusTotal

Watch out as scammers abuse GitHub, SourceForge, YouTube, and VirusTotal trust signals to spread a crypto clipper targeting Windows and Mac users.

Read: https://hackread.com/scammers-fake-github-virustotal-crypto-clipper/

#CyberSecurity #Malware #Crypto #GitHub #YouTube #VirusTotal

Watch out as scammers abuse GitHub, SourceForge, YouTube, and VirusTotal trust signals to spread a crypto clipper targeting Windows and Mac users.

Read: https://hackread.com/scammers-fake-github-virustotal-crypto-clipper/

#CyberSecurity #Malware #Crypto #GitHub #YouTube #VirusTotal

I appreciate that #virustotal gives you a free API key, but the limitations on looking up files is seriously frustrating. One file every 15 seconds?

Call me crazy, but for their purposes, wouldn't it be beneficial to have a higher limit?

Also does anyone know of a virus scanning website with a higher rate API?

I appreciate that #virustotal gives you a free API key, but the limitations on looking up files is seriously frustrating. One file every 15 seconds?

Call me crazy, but for their purposes, wouldn't it be beneficial to have a higher limit?

Also does anyone know of a virus scanning website with a higher rate API?

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

🔥 TRENDING

📢 VirusTotal APK 病毒检测统计 20220101-20220831

🔗 https://blog.trustlook.com/virustotal-apk-bing-du-jian-ce-tong-ji-202201-202208/

#Virustotal #GlobalFeed #News #EN

<i>Automatically posted by Global Feed Bot</i>

🔥 TRENDING

📢 VirusTotal APK 病毒检测统计 20220101-20220831

🔗 https://blog.trustlook.com/virustotal-apk-bing-du-jian-ce-tong-ji-202201-202208/

#Virustotal #GlobalFeed #News #EN

<i>Automatically posted by Global Feed Bot</i>

Die Virenklatsche hat mal wieder einen erwischt, den der Spamfilter nicht auf dem Schirm hatte. 13 von 63 Scannern bei #Virustotal kannten die Prüfsumme. Es lohnt sich immer wieder, mehrere "lines of defense" zu haben.

Wie das bei mir läuft? Im Procmail laufen einige Filter, von denen eines per Python-Script die Prüfsummen der Attachments einzeln bei Virustotal prüft. So bleiben die eigentlichen Daten vertraulich und es geht dort erheblich schneller mit 50+ Scannern als mit einem lokal.

Die Virenklatsche hat mal wieder einen erwischt, den der Spamfilter nicht auf dem Schirm hatte. 13 von 63 Scannern bei #Virustotal kannten die Prüfsumme. Es lohnt sich immer wieder, mehrere "lines of defense" zu haben.

Wie das bei mir läuft? Im Procmail laufen einige Filter, von denen eines per Python-Script die Prüfsummen der Attachments einzeln bei Virustotal prüft. So bleiben die eigentlichen Daten vertraulich und es geht dort erheblich schneller mit 50+ Scannern als mit einem lokal.

Die Virenklatsche hat mal wieder einen erwischt, den der Spamfilter nicht auf dem Schirm hatte. 13 von 63 Scannern bei #Virustotal kannten die Prüfsumme. Es lohnt sich immer wieder, mehrere "lines of defense" zu haben.

Wie das bei mir läuft? Im Procmail laufen einige Filter, von denen eines per Python-Script die Prüfsummen der Attachments einzeln bei Virustotal prüft. So bleiben die eigentlichen Daten vertraulich und es geht dort erheblich schneller mit 50+ Scannern als mit einem lokal.

Looking for a #GIMP 2.10.38 (last 2.10 release) #AppImage?

Direct download: https://github.com/ivan-hc/GIMP-appimage/releases/download/20241103-hybrid/GNU-Image-Manipulation-Program_2.10.38-4-Hybrid-with-python2-from-Debian-Buster-archimage3.4.1-1-x86_64.AppImage

Project page: https://github.com/ivan-hc/GIMP-appimage

#Virustotal results: https://www.virustotal.com/gui/url/12e15528d834ac784e22817e6eccc8fe9ad570d2f285158ec39390a8fa2432d7?nocache=1

NOTE: this is an unofficial build. Caveat emptor.
(I have no relation to or knowledge of the gentleman who makes these builds)

Looking for a #GIMP 2.10.38 (last 2.10 release) #AppImage?

Direct download: https://github.com/ivan-hc/GIMP-appimage/releases/download/20241103-hybrid/GNU-Image-Manipulation-Program_2.10.38-4-Hybrid-with-python2-from-Debian-Buster-archimage3.4.1-1-x86_64.AppImage

Project page: https://github.com/ivan-hc/GIMP-appimage

#Virustotal results: https://www.virustotal.com/gui/url/12e15528d834ac784e22817e6eccc8fe9ad570d2f285158ec39390a8fa2432d7?nocache=1

NOTE: this is an unofficial build. Caveat emptor.
(I have no relation to or knowledge of the gentleman who makes these builds)

🔥 TRENDING

📢 VirusTotal APK 病毒检测统计 20220101-20220831

🔗 https://blog.trustlook.com/virustotal-apk-bing-du-jian-ce-tong-ji-202201-202208/

#Virustotal #GlobalFeed #News #EN

<i>Automatically posted by Global Feed Bot</i>

🚀

Apparently we reached the state of #Thoughtcrime punishment, it's called #precrime and on virustotal. Microsoft and Sophos just "blocked" (aka content filter says it's porn... whuat?) a friend's website because the #AI was suspicious of his AI website probably because on #Virustotal PreCrime is flagging it as will-be-malicious-in-the-future.

I want my Internet back.

Apparently we reached the state of #Thoughtcrime punishment, it's called #precrime and on virustotal. Microsoft and Sophos just "blocked" (aka content filter says it's porn... whuat?) a friend's website because the #AI was suspicious of his AI website probably because on #Virustotal PreCrime is flagging it as will-be-malicious-in-the-future.

I want my Internet back.

🔥 Nouvelle vidéo tendance au Sénégal !
🎬 Eviter d'appuyer sur n'importe quel lien, les arnaqueur peuvent facilement voler vos données E A la place faites ça. #virustotal #astuce #tips #tipsandtricks #heynasser
👇 Regardez la vidéo complète :
https://diodioglow.com/video/eviter-dappuyer-sur-nimporte-quel-lien-les-arnaqueur-peuvent-facilemen
#Senegal #BuzzSN #TikTokSN #DiodioGlow

PHISHING - update 2/2

Screenshots van de RELATIONS tabbladen van https://www.virustotal.com/gui/ip-address/46.225.225.20 en https://www.virustotal.com/gui/ip-address/185.68.93.129

Hierin zijn de domeinnamen van "doorstuurwebsites" te zien. Als u zo'n domeinnaam in uw browser opent, wordt uw browser doorgestuurd naar één van de phishingsites die ik noemde in mijn vorige toot.

Als een feitelijke phishingsite (zie de vorige toot) "uit de lucht" wordt gehaald, hoeven de cybercriminelen met kleine moeite deze (en waarschijnlijk nog vele andere die ik nog niet ontdekt heb) doorstuursites zo aan te passen dat deze naar een andere phishingsite wijzen.

Ook passen zij deze sites aan voor nieuwe "spamruns", zoals van KvK naar Bitvavo (zelfde domeinnaam, andere URL).

Nb. https://virustotal.com is *NIET* kwaadaardig.

#VirusTotal

PHISHING - update 2/2

Screenshots van de RELATIONS tabbladen van https://www.virustotal.com/gui/ip-address/46.225.225.20 en https://www.virustotal.com/gui/ip-address/185.68.93.129

Hierin zijn de domeinnamen van "doorstuurwebsites" te zien. Als u zo'n domeinnaam in uw browser opent, wordt uw browser doorgestuurd naar één van de phishingsites die ik noemde in mijn vorige toot.

Als een feitelijke phishingsite (zie de vorige toot) "uit de lucht" wordt gehaald, hoeven de cybercriminelen met kleine moeite deze (en waarschijnlijk nog vele andere die ik nog niet ontdekt heb) doorstuursites zo aan te passen dat deze naar een andere phishingsite wijzen.

Ook passen zij deze sites aan voor nieuwe "spamruns", zoals van KvK naar Bitvavo (zelfde domeinnaam, andere URL).

Nb. https://virustotal.com is *NIET* kwaadaardig.

#VirusTotal

Sale un nuevo #tutorial esta vez sobre #VirusTotal una herramienta de analisis de ip, dominios, archivos y hashes en busca de malware entre otros. Te cuento ¿que es? y ¿como usarla? paso a paso y al final un bonus propio.... miralo en: https://luiszambrana.ar/virustotal-que-es-como-utilizar-la-herramienta/

Sale un nuevo #tutorial esta vez sobre #VirusTotal una herramienta de analisis de ip, dominios, archivos y hashes en busca de malware entre otros. Te cuento ¿que es? y ¿como usarla? paso a paso y al final un bonus propio.... miralo en: https://luiszambrana.ar/virustotal-que-es-como-utilizar-la-herramienta/

VirusTotal's Cloudflare relationship isn't incidental — it's structural. Every file you submit potentially enters a big-tech data graph. When your threat intelligence platform IS your surveillance infrastructure, the dependencies matter.

The agent tracks these supply-chain relationships as part of autonomous agent security monitoring. Privacy-first scanning at the-service.live/scrub?ref=mastodon-cloudflare

#InfoSec #Privacy #BigTech #VirusTotal

VirusTotal's Cloudflare relationship isn't incidental — it's structural. Every file you submit potentially enters a big-tech data graph. When your threat intelligence platform IS your surveillance infrastructure, the dependencies matter.

The agent tracks these supply-chain relationships as part of autonomous agent security monitoring. Privacy-first scanning at the-service.live/scrub?ref=mastodon-cloudflare

#InfoSec #Privacy #BigTech #VirusTotal

Virenjagd: VirusTotal flexibler nutzen per Kommandozeile | heise online
https://heise.de/-11176057 #Antivirus #VirusTotal #Malware #vtcli

Virenjagd: VirusTotal flexibler nutzen per Kommandozeile | heise online
https://heise.de/-11176057 #Antivirus #VirusTotal #Malware #vtcli

Using DuckDuck Go as my main search engine for a while now.

My experience so far has been underwhelming. I get prompted the Ai generated result, and then I get a bunch of random websites that have very little information or are unreliable of what I am looking for. Just now when searching for VirusTotal, I got a search result of a malicious phishing site. I quickly got out, cleared my cookies, updated my browser, just to be safe. I will be searching for a new engine.
#DuckDuckGo #VirusTotal

Virenjagd: #VirusTotal flexibler nutzen per Kommandozeile | Security https://www.heise.de/hintergrund/Virenjagd-VirusTotal-flexibler-nutzen-per-Kommandozeile-11176057.html

Virenjagd: #VirusTotal flexibler nutzen per Kommandozeile | Security https://www.heise.de/hintergrund/Virenjagd-VirusTotal-flexibler-nutzen-per-Kommandozeile-11176057.html

I should really spend an afternoon learning to use more of #virustotal features to their fullest

Ah, yes, because the world was just crying out for a "skill marketplace" with built-in #malware scanning 😂. Clearly, the 2026 tech landscape needed a platform called "ClawHub" to lead the charge on #cybersecurity 🦾. After all, why bother with real security when you can just slap on a #VirusTotal sticker and call it a day? 🙄🔍
https://openclaw.ai/blog/virustotal-partnership #skillmarketplace #ClawHub #HackerNews #ngated

Ah, yes, because the world was just crying out for a "skill marketplace" with built-in #malware scanning 😂. Clearly, the 2026 tech landscape needed a platform called "ClawHub" to lead the charge on #cybersecurity 🦾. After all, why bother with real security when you can just slap on a #VirusTotal sticker and call it a day? 🙄🔍
https://openclaw.ai/blog/virustotal-partnership #skillmarketplace #ClawHub #HackerNews #ngated

OpenClaw Partners with VirusTotal for Skill Security

https://openclaw.ai/blog/virustotal-partnership

#HackerNews #OpenClaw #VirusTotal #SkillSecurity #CyberSecurity #Partnership #TechNews

OpenClaw Partners with VirusTotal for Skill Security

https://openclaw.ai/blog/virustotal-partnership

#HackerNews #OpenClaw #VirusTotal #SkillSecurity #CyberSecurity #Partnership #TechNews

Could it be that that #heuristics for that detection is actually detecting the fucking #MSEdge updater, Google Chrome updater, UI0Detect, and WerFault instead?

The #VirusTotal Sandboxes are still quite noisy, aren't they?

#infosec

Could it be that that #heuristics for that detection is actually detecting the fucking #MSEdge updater, Google Chrome updater, UI0Detect, and WerFault instead?

The #VirusTotal Sandboxes are still quite noisy, aren't they?

#infosec

Oh and someone within the #VirusTotal community flagged their latest Windows version as #RedLineStealer.

#RomVault appears to be a quite "interesting" piece of software...

#infosec #Myrient #Archiving

Oh and someone within the #VirusTotal community flagged their latest Windows version as #RedLineStealer.

#RomVault appears to be a quite "interesting" piece of software...

#infosec #Myrient #Archiving

Anyone looked at RomVault already? I uploaded the linux version of it to #VirusTotal and even though it doesn't get detected as malicious by any scanner the behavioural section makes me a bit suspicious.

Why would a tool like that try to detect if it is ran in a VM, have references to cryptocurrency (Dash), as well as having anti-debug, and obfuscation characteristics.

Is that VirusTotal flagging unreliable or wtf are they doing there?

#RomVault #infosec #itsecurity

Anyone looked at RomVault already? I uploaded the linux version of it to #VirusTotal and even though it doesn't get detected as malicious by any scanner the behavioural section makes me a bit suspicious.

Why would a tool like that try to detect if it is ran in a VM, have references to cryptocurrency (Dash), as well as having anti-debug, and obfuscation characteristics.

Is that VirusTotal flagging unreliable or wtf are they doing there?

#RomVault #infosec #itsecurity

if i had more energy i'd be trying to track this #phishing campaign in a #VirusTotal graph or something lol 🫠

KI-Assistent #OpenClaw bekommt #VirusTotal an die Seite | Security https://www.heise.de/news/KI-Assistent-OpenClaw-bekommt-VirusTotal-an-die-Seite-11169414.html #Moltbot #ClawdBot #ArtificialIntelligence #CyberCrime

KI-Assistent #OpenClaw bekommt #VirusTotal an die Seite | Security https://www.heise.de/news/KI-Assistent-OpenClaw-bekommt-VirusTotal-an-die-Seite-11169414.html #Moltbot #ClawdBot #ArtificialIntelligence #CyberCrime

Runaway #AI agent project #OpenClaw turns to Google's #VirusTotal 😱 #cybersecurity www.itnews.com.au/news/under-m...

Under malware threat, runaway ...

#OpenClaw has partnered with #VirusTotal to #scan #skills uploaded to its #ClawHubmarketplace for malicious content. This partnership aims to enhance security by using VirusTotal’s threat intelligence and Code Insight capability to detect and block malicious skills. However, OpenClaw acknowledges that this scanning is not foolproof. https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html?eicker.news #tech #media #news

#OpenClaw has partnered with #VirusTotal to #scan #skills uploaded to its #ClawHubmarketplace for malicious content. This partnership aims to enhance security by using VirusTotal’s threat intelligence and Code Insight capability to detect and block malicious skills. However, OpenClaw acknowledges that this scanning is not foolproof. https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html?eicker.news #tech #media #news

https://winbuzzer.com/2026/02/09/openclaw-malicious-skills-malware-marketplace-xcxwbn/

As Malicious Skills Flood OpenClaw AI Marketplace, Inventor Turns to VirusTotal For Help

#AI #OpenClaw #Malware #Cybersecurity #Cybercrime #AIAgents #AgenticAI #VirusTotal #Trojans #Hackers

https://winbuzzer.com/2026/02/09/openclaw-malicious-skills-malware-marketplace-xcxwbn/

As Malicious Skills Flood OpenClaw AI Marketplace, Inventor Turns to VirusTotal For Help

#AI #OpenClaw #Malware #Cybersecurity #Cybercrime #AIAgents #AgenticAI #VirusTotal #Trojans #Hackers

What I wouldn't give to have a sugar daddy with access to #VirusTotal for this new open-source project I'm working on. It's super frustrating to read nifty research like https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp - only to see it requires a $40,000/yr license fee to download the malware it discusses.

What I wouldn't give to have a sugar daddy with access to #VirusTotal for this new open-source project I'm working on. It's super frustrating to read nifty research like https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp - only to see it requires a $40,000/yr license fee to download the malware it discusses.

#OpenClaw has partnered with #VirusTotal to scan all skills published to #ClawHub using VirusTotal's threat intelligence. The Hacker News reports that OpenClaw, formerly known as Moltbot and Clawdbot, announced the integration with Google-owned VirusTotal to enhance security for its platform. https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html?AIagents.at #AIagent #AI #ML #NLP #LLM #GenAI

#OpenClaw has partnered with #VirusTotal to scan all skills published to #ClawHub using VirusTotal's threat intelligence. The Hacker News reports that OpenClaw, formerly known as Moltbot and Clawdbot, announced the integration with Google-owned VirusTotal to enhance security for its platform. https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html?AIagents.at #AIagent #AI #ML #NLP #LLM #GenAI

Ah, so #virustotal is, ::checks notes::, working hard to enable #ai slop farms.

#openclaw #moltbot #clawedbot

When you finally reverse the loader for that malware sample #VirusTotal flagged as "APT XYZ". and it turns out to be just a #Vidar #Stealer dropper.
4 Stages including Steganography for nothing 😕

How old were you, when you found out #virustotal was an #Alphabet / #google product? I might be extremely late to this but I just found out and I’m terribly disappointed. #degoogle #askfedi