Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 993557" data-attributes="member: 83059">Yeah that was my best guess for what &#039;abch&#039; was. I didn&#039;t want to be unethical and submit something harmless to Malware Bazaar but I suspected that they might be adding cloud hashes for almost everything in Malware Bazaar or perhaps automated sandboxes where certain criteria are met.I personally don&#039;t like the practice. While it may improve zero-day detections some, I feel it is more of a cheap trick to make performance look strong when amateur malware testers try the product. FWIW DeepGuard can be a little touchy with unknown applications, but it&#039;s not the most sensitive. I have been doing some ASP.NET Core app development this past month and had to remove Emsisoft Business Security from my server because its behavior blocker kept flagging almost every compilation product of an ASP.NET Core webapp as behavior &quot;trojan horse&quot;. And because the hashes and paths all change as the app gets compiled per commit, I can&#039;t whitelist it.</blockquote>

[QUOTE="MacDefender, post: 993557, member: 83059"] Yeah that was my best guess for what 'abch' was. I didn't want to be unethical and submit something harmless to Malware Bazaar but I suspected that they might be adding cloud hashes for almost everything in Malware Bazaar or perhaps automated sandboxes where certain criteria are met. I personally don't like the practice. While it may improve zero-day detections some, I feel it is more of a cheap trick to make performance look strong when amateur malware testers try the product. FWIW DeepGuard can be a little touchy with unknown applications, but it's not the most sensitive. I have been doing some ASP.NET Core app development this past month and had to remove Emsisoft Business Security from my server because its behavior blocker kept flagging almost every compilation product of an ASP.NET Core webapp as behavior "trojan horse". And because the hashes and paths all change as the app gets compiled per commit, I can't whitelist it. [/QUOTE]

Verification