We compile the most searched-for threats from the MetaDefender Cloud database over the past month, and you can see them below along with data about how well they are detected by our MetaDefender Core Packages. Please note that the detection data comes from Software Development Kit (SDK) and Command Line Interface (CLI) package versions of these anti-malware engines, using static analysis only, and not from endpoint desktop applications which may be capable of enhanced behavioral and other dynamic analysis, so detection results may differ significantly from commercial endpoint performance. The data below should not be used for comparing performance of desktop or server anti-malware applications. To emphasize the value of multi-scanning, we wanted to show how the OPSWAT MetaDefender Core packages can detect the top threats in our list. As more scan engines are added, more of the top threats are detected, indicating the value added with each MetaDefender Core Packages increment.
Hover over the packages to see the included anti-malware engines.
Learn more about the data and how it is collected by reading the documentation and disclaimers about the top threats.
The threats listed above are the most searched-for threats from our database of hashes over the last seven days. The hashes come from files that have been uploaded through our multi-scanning tool, MetaDefender Cloud, and we filter these down to those that have been flagged as malicious by five or more antivirus engines: we do this in order to limit false positives, or incorrect threat detections. We did a few internal tests to find the "sweet spot" of the minimum number of engines to detect the threat and determined that five worked best for our data; we didn’t want too low of a minimum, which could yield too many false positives, but too high of a minimum could eliminate real, new, interesting threats.
Many of the hash searches on MetaDefender Cloud are performed as part of endpoint risk assessment, so many of the top threats you will see are Windows and Mac system and process files. Threats that are found most commonly in email attachments, for example, may not show here. Scan engines designed exclusively for Android malware have been excluded from these statistics because the top searched threats in our database tend to be non-Android malware. We do include Potentially Unwanted Programs (PUPs) and Potentially Unwanted Applications (PUAs) in the top threats; while they may not actually be considered malware, their behavior and use can still have unintended security or privacy impacts, and many antivirus engines are flagging these types of applications as adware, grayware, toolbars, etc.
No. The anti-malware engines we use on MetaDefender Cloud are SDK and CLI packages using signature and heuristic-based detection methods, or static analysis. With static analysis, the file is not executed, but is analyzed for malicious patterns and checked for known malware signatures. Antivirus products installed on your computer often also make use of dynamic analysis, in which the behavior of the file is observed. Behavioral detection methods, often using a sandbox environment to execute the file, can identify malicious activity that only occurs at runtime and that would not be caught by static analysis. For this reason, as well as because of the variability in configurations in any individual or company’s deployment of their antivirus product, the results we show here may not match the results you would observe from your installed antivirus software.
The results here only indicate detection of a threat, not necessarily the ability to quarantine, clean, delete or otherwise remediate the threat. When determining the effectiveness of any anti-malware product for protecting an endpoint machine, it is important to evaluate its ability to detect as well as to remediate threats. This data does not address threat remediation.
To compare the performance of anti-malware products, we recommend using comprehensive anti-malware tests from companies like AV-Test, AV Comparatives, Virus Bulletin, ICSA Labs, West Coast labs, and others.
No single anti-malware engine is perfect 100% of the time, and using multiple engines to scan for threats allows you to take advantage of the strengths of each individual engine and to guarantee the earliest possible detection. While the data above shows only a subset of the most common threats in the wild and utilizes only the Windows-based anti-malware engines in MetaDefender Cloud, it provides an indication of the variability of detection rates of common malware by the anti-malware community. You can use this data to investigate current threats as well as to watch detection of new threats grow over time.
In addition, command line versions of anti-malware products are often integrated into a spam filter or web security product, and these results may provide more insight for those implementations, though the specific configuration can also affect detection rates.
MetaDefender Cloud intends to be an unbiased service, not promoting one engine over another, and the data above is not intended for comparing the performance of specific engines, for reasons including:
Files uploaded to MetaDefender Cloud are shared with the antivirus engine vendors to help in improving their services and products.
For a demonstration of the technology or for more information, please contact us.Contact Us