Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1111135" data-attributes="member: 32260">Understand. I mentioned this script because it is most probably not a false positive. Kaspersky correctly detected it as malicious. This script may also be an artifact after running the EXE (detected by Kaspersky). So, those two files can be related to one malware that was mitigated by Comodo Script Analysis.You can check this possibility by deleting the content of &quot;C:\ProgramData\Comodo\Cis\tempscript folder&quot; and running only that EXE sample. If Comodo does not create the PS1 script, those files are unrelated.Edit.It seems that the EXE sample was a downloader, but the domain with the final payload did not respond (dead sample). The payload (exe.exe) would be most probably contained by Comodo.[URL unfurl=&quot;true&quot;]https://any.run/report/75d96dfe70912f3f2c5b669ebac010a83904daea9a908c5352063f1508d8ed58/49433837-f95c-4cc4-9e69-76a313569abc[/URL][URL unfurl=&quot;true&quot;]https://app.any.run/tasks/49433837-f95c-4cc4-9e69-76a313569abc[/URL]</blockquote>

[QUOTE="Andy Ful, post: 1111135, member: 32260"] Understand. I mentioned this script because it is most probably not a false positive. Kaspersky correctly detected it as malicious. This script may also be an artifact after running the EXE (detected by Kaspersky). So, those two files can be related to one malware that was mitigated by Comodo Script Analysis. You can check this possibility by deleting the content of "C:\ProgramData\Comodo\Cis\tempscript folder" and running only that EXE sample. If Comodo does not create the PS1 script, those files are unrelated. Edit. It seems that the EXE sample was a downloader, but the domain with the final payload did not respond (dead sample). The payload (exe.exe) would be most probably contained by Comodo. [URL unfurl="true"]https://any.run/report/75d96dfe70912f3f2c5b669ebac010a83904daea9a908c5352063f1508d8ed58/49433837-f95c-4cc4-9e69-76a313569abc[/URL] [URL unfurl="true"]https://app.any.run/tasks/49433837-f95c-4cc4-9e69-76a313569abc[/URL] [/QUOTE]

Verification