Advice Request False postive from VirusTotal?

[fabiobr]

I was on Malware Hub seeing the VirusTotal page and Kaspersky pop up with this, why that happened? Someone knows why?

Download blocked, Object detected.

 

[silversurfer]

I was on Malware Hub seeing the VirusTotal page and Kaspersky pop up with this, why that happened? Someone knows why?

Download blocked, Object detected.

Looks like the hash/VT link of my latest sample #Qbot

Kaspersky detection on your screenshot is the same than on VT:
HEUR:Trojan.PowerShell.Generic

Weird, that block still happening or just once before?

 

[fabiobr]

Looks like the hash/VT link of my latest sample #Qbot

Kaspersky detection on your screenshot is the same than on VT:
HEUR:Trojan.PowerShell.Generic

Weird, that block still happening or just once before?

Every time I update the page:

VirusTotal

VirusTotal

www.virustotal.com

 

[struppigel]

Do you have VT intelligence and can see the content tab?
Because that shows the malicious powershell string. I assume they see that string in the browser. It's an FP in the sense that it detects the string in the wrong context.

 

[fabiobr]

I tried to talk to live chat but they ask me if I'm working with an infected bin I should not do it and therefore that's an infection, I tried to say that I'm not working on it and it's just an upload on VT which I just see it, I didn't make the upload, but they don't understand it.

 

[fabiobr]

Do you have VT intelligence and can see the content tab?
Because that shows the malicious powershell string. I assume they see that string in the browser. It's an FP in the sense that it detects the string in the wrong context.

View attachment 244680

I'm not logged in, it's for logged users only or only on paid version?

 

[struppigel]

They should easily be able to replicate the FP by just browsing the same VT page while logged in with an Intelligence account.

 

[harlan4096]

With KTS2020k I'm not getting any detection here...

 

[fabiobr]

They should easily be able to replicate the FP by just browsing the same VT page while logged in with an Intelligence account.

Yes, but I didn't know why this is showing to me if I not have such account. Maybe it's hidden?

 

[fabiobr]

Anyway, I think any detection is sent to KSN servers and they can see it.

 

[struppigel]

I'm not logged in, it's for logged users only or only on paid version?

In that case I am not sure what is causing this. Without the paid version you cannot see the file contents.

 

[Huchim]

I also get the detection, using KSC 2021MR1