[galaxy_gas]

its Typical that the Virus Writer will use their own service, there is criminal virustotal-clones that run many AV in VM and return the Results, because virustotal will share all binaries, anything upload in Virustotal will be detteceted shortly if it is not.

[47282847]

Isn’t it still that when signatures are added at some point it turns out that the malware code has been uploaded months before, or did that change?