Serious Discussion False Positive by Kaspersky or Real Malware?

[Khushal]

Further discovery by me led to the following being the root cause of dtection (or false detection)

VirusTotal

VirusTotal

www.virustotal.com

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

What is your opinion?
Is Malware Identification by strings and mutexes always reliable?

 

[Parkinsond]

K lately was giving me FP from time to time, of course not as much as B.

 

[harlan4096]

Where to find the installer? Impossible unless to register in Palo Alto... now 5 detections at VT, but not from main avs except K...

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

VirusTotal

VirusTotal

www.virustotal.com

 

[Khushal]

Where to find the installer? Impossible unless to register in Palo Alto... now 5 detections at VT, but not from main avs except K...

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

VirusTotal

VirusTotal

www.virustotal.com

no idea but that is not the main point
f979cca83cf316e30a73b478613ebc5578fa9b14b4b29d9f989fb0f7ca8a11bf according to VT and Thor has mimikatz strings.

 

[Wrecker4923]

What is your opinion?
Is Malware Identification by strings and mutexes always reliable?

Do you happen to know what strings and mutexes were used to tag the .exe? I suppose they must be unique to Mimikatz when they were added to the rulesets.

 

[ForgottenSeer 114717]

View attachment 290922

Further discovery by me led to the following being the root cause of dtection (or false detection)

VirusTotal

VirusTotal

www.virustotal.com

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

What is your opinion?
Is Malware Identification by strings and mutexes always reliable?

False Positive, but not completely False Positive.

PaloAlto has been having this trouble with UaCredService for over 10 years because PaloAlto uses Mimikitaz code within UaCredService. More specifically, UaCredService takes the domain user/password and checks it over the internet. UaCredService performs credentials verification when the credential detection feature is enabled. When a corporate (usually a domain) user uses their credentials to access some resource, their credentials are sent to the UaCredService which, in turn, checks the user's credentials over a network with a connected Credential Verification or Authentication Service (not a PaloAlto product or service). This entire process mimics Mimikatz and UaCredService uses Mimikatz code.

Submit ticket to PaloAlto or search available PaloAlto support forums for confirmation of further details.

 

[Khushal]

False Positive, but not completely False Positive.

PaloAlto has been having this trouble with UaCredService for over 10 years because PaloAlto uses Mimikitaz code within UaCredService. More specifically, UaCredService takes the domain user/password and checks it over the internet. UaCredService performs credentials verification when the credential detection feature is enabled. When a corporate (usually a domain) user uses their credentials to access some resource, their credentials are sent to the UaCredService which, in turn, checks the user's credentials over a network with a connected Credential Verification or Authentication Service (not a PaloAlto product or service). This entire process mimics Mimikatz and UaCredService uses Mimikatz code.

Submit ticket to PaloAlto or search available PaloAlto support forums for confirmation of further details.

Thank You i'll lrequest if u would reply to malwarehunter team on X so that there is more clarity.