Recent Results in March 2024

Latest DATA FROM the advanced in-the-wild malware test

Threat Landscape in March 2024

tested
solutions
10
unique
SAMPLES
400
malware hosted over HTTP
430
malware hosted over HTTPS
50
average malicious changes [1]
30

PRE-LAUNCH level prevention

64 %

POST-LAUNCH level protection

37 %

average blocked malware [2]

99 %

Potential data breaches

1
30 s

Average Industry
Remediation Time

* based on data telemetry

0 s

The quickest average remediation time

[1] The number of harmful changes made to Windows during dynamic analysis of the malware sample.
[2] Average blocking of malware by all tested solutions, regardless of level of prevention or protection.

TOP 3

HIJACKED SERVERS LOCATION

150
90
60

TOP 3

TLD COMPROMISED DOMAINS​

.com

96

.ru

11

.online

10

TOP 10

FASCINATING SIGNATURES

DeepScan:Generic.Malware.SFL
Trojan.CryptZ.Marte.1.Gen
VB:Trojan.Emeka.Dunihi.987
Trojan.Stealer.7
Trojan.Ransom.PIC
Generic.MSIL.PasswordStealerA
Trojan.Metasploit.A
Worm.Dorkbot.V
Application.LoadMoney.S
Generic.JS.Malicord.C.BFBBAC38

* data based on the mks_vir engine

LOLBins in statistical terms

Legitimate and trusted software and built-in components in Windows are often used by cybercriminals to hide malicious activity. The so-called “Living off the Land Binaries” (LOLBin) are necessary for the proper functioning of the operating system. During a cyberattack, it can be difficult or impossible to block them, making them a very attractive method for malware developers. Below we present the most commonly used LOLBin in this edition of the test.

cmd.exe
3609
svchost.exe
2154
sc.exe
765
rundll32.exe
747
iexplorer.exe
735
tor.exe
718
consent.exe
630

Malware Comparison Table in March 2024

The following summary shows a comparison of tested solutions to protect workstations against malware. We encourage you to become familiar with a detailed description and read our testing methodology in order to understand the results.

PRE-LAUNCH: The classification concerns detecting malware samples before they are launched in the system.
POST-LAUNCH: The analysis level, i.e. a virus has been run and blocked by a tested product.
FAIL: The failure, i.e. a virus hasn’t been blocked and it has infected a system.
Sandbox Column: Number of indicators, i.e. malicious changes made to the system without the anti-virus installed.

Automatic Average Remediation Time (RT): The time expressed in seconds counted from the introduction of malware into the system by the browser, through the launch to the detecting and resolving a security incident.

Certificates are granted to solutions that are characterized by a high level of security, with a rating of at least 99% of blocked threats in the Advanced In-The-Wild Malware Test.

Our tests comply with the guidelines of the Anti-Malware Testing Standards Organization.
Details about the test are available at this website as well as in our methodology.

Recent Results in March 2024

Avast Free Antivirus
excellent
PRE-LAUNCH:
74.07%
POST-LAUNCH:
25.93%

Blocked: 459/459
Total: 100%
RT: 10 seconds

Bitdefender Total Security
excellent
PRE-LAUNCH:
91.58%
POST-LAUNCH:
8.16%
FAIL:
0.22%

Blocked: 458/459
Total: 99.78%
RT: 1.484 second
FAIL: 1

Comodo-logo.svg
Comodo Internet Security
excellent
PRE-LAUNCH:
45.32%
POST-LAUNCH:
54.68%

Blocked: 459/459
Total: 100%
RT: 44 seconds

Emsisoft Enterprise Security + EDR
excellent
PRE-LAUNCH:
51.85%
POST-LAUNCH:
48.15%

Blocked: 459/459
Total: 100%
RT: 82 seconds

Eset Smart Security Premium
excellent
PRE-LAUNCH:
75.38%
POST-LAUNCH:
24.4%
FAIL:
0.22%

Blocked: 458/459
Total: 99.78%
RT: 1.433 seconds
FAIL: 1

F-Secure Total
excellent
PRE-LAUNCH:
87.7%
POST-LAUNCH:
12.2%

Blocked: 459/459
Total: 100%
RT: 0.559 second

Malwarebytes Premium
excellent
PRE-LAUNCH:
86.93%
POST-LAUNCH:
13.07%

Blocked: 459/459
Total: 100%
RT: 20 seconds

mcafee logo
McAfee Total Protection
excellent
PRE-LAUNCH:
91.07%
POST-LAUNCH:
8.93%

Blocked: 459/459
Total: 100%
RT: 1.167 second

Microsoft Defender for Business + EDR
excellent
PRE-LAUNCH:
9.15%
POST-LAUNCH:
90.85%

Blocked: 459/459
Total: 100%
RT: 154 seconds

Panda-Security-logo
Panda Dome Advanced
excellent
PRE-LAUNCH:
86.27%
POST-LAUNCH:
13.51%
FAIL:
0.22%

Blocked: 458/459
Total: 99.78%
RT: 24 seconds
FAIL: 1

ThreatDown Endpoint Protection + EDR
excellent
PRE-LAUNCH:
88.02%
POST-LAUNCH:
11.92%

Blocked: 459/459
Total: 100%
RT: 17 seconds

Webroot Antivirus
excellent
PRE-LAUNCH:
42.05%
POST-LAUNCH:
57.95%

Blocked: 459/459
Total: 100%
RT: 69 seconds

Xcitium ZeroThreat Advanced + EDR
excellent
PRE-LAUNCH:
8.28%
POST-LAUNCH:
91.72%

Blocked: 459/459
Total: 100%
RT: 12 seconds

Related Publication in Details

Dive into our latest publication, dedicated to security test against malware. Uncover analyses, methodology, and results that provide invaluable insights into the latest edition of the Advanced In-The-Wild Malware Test.

See the previous results

You can always go back in time and check how each individual security product performed during previous editions of the test. We make the results from all previous tests available to you to verify if your favorite developer has improved protection against latest malware in his security software.