It Hurt Itself in Confusion: No Distribute Scanners and Stealthy Malware

This presentation examines No Distribute Scanners (NDSs)—also known as "counter AV"—and their critical role in facilitating cybercrime. NDSs are standalone websites that allow attackers to scan malicious files against dozens of antivirus products without sending detection reports back to the vendors, keeping malware stealthy. The speakers emphasize the severity of these services by opening with the case of Scan4You, run by Ruslan Bondars, which operated for eight years with 30,000 registered users before Bondars received a 14-year US prison sentence.

**Key NDS Services and Features:** The presentation surveys approximately nine different NDS platforms. DynCheck emerged as the dominant service after Scan4You's takedown in 2016, serving both Russian and English-speaking criminal communities. All examined NDSs offered API access and static analysis; only two provided dynamic scanning capabilities. Static analysis inspects file format, string patterns, and entropy without execution, while dynamic analysis executes samples in isolated environments and monitors behavior, requiring significantly more computational resources (potentially 50+ virtual machines to test against 50+ AV products daily).

**Pricing Models:** Three distinct pricing structures emerged: free models (static scanners only, supported by advertising), single/bundle scan pricing (DynCheck's static scan against one AV product cost approximately one cent), and subscriptions ($50–$300 USD monthly for DynCheck, depending on features). Subscription models typically bundle static and dynamic scans with API access.

**Malware Developer Workflow:** The speakers outline how attackers exploit NDSs throughout the malware lifecycle: (1) Development—submitting code to identify which AV signatures trigger, then modifying to evade detection; (2) Advertising—displaying scan results as proof of quality (e.g., "only detected by 3 of 45 vendors"); and (3) Exploitation—using periodic scans every 5 days to monitor detection status and using domain-check features to verify command-and-control servers aren't blacklisted before launching campaigns.

**Advanced Integration:** The research reveals deeper integration of NDSs into the criminal ecosystem. Crypters like Cyber Seal embed NDS functionality (CyberScan) to automatically verify encrypted malware against AV vendors. NDSs also offer API access for automation and integration into third-party tools, and some platforms (notably DynCheck) operate as back-end infrastructure for other NDS services, creating a tiered ecosystem.

**Architecture Insights:** The speakers explain why dynamic scanners are rare: static analysis requires only command-line AV execution—simple and scalable. Dynamic scanning demands isolated virtual machines, daily AV database updates across all instances, snapshots for system reversion, and continuous infrastructure maintenance. This complexity increases operational costs and explains why most freely available NDSs offer only static scanning.

**Key Takeaways:** Antivirus is not a comprehensive solution; threat actors actively monitor vendor responses and adapt accordingly. Researchers should identify major players in cybercriminal ecosystems, particularly high-impact services like DynCheck. Malware authors inadvertently provide intelligence by sharing NDS scan results, allowing defenders to identify emergent threats and determine which malware variants successfully evade detection.