Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 984803" data-attributes="member: 32260">The CyberCapture sandbox was not triggered:[ATTACH=full]265993[/ATTACH][URL unfurl=&quot;true&quot;]https://support.avast.com/en-us/article/Antivirus-CyberCapture-FAQ/[/URL]CyberCapture can recognize that the file was downloaded from the Internet when the file has got MOTW. One can force CyberCapture to use the sandbox for any EXE file by adding the MOTW. This is done for example by Hard_Configurator or RunBySmartscreen.In theory, the malware can be undetected by the CyberCapture sandbox, but this happens very rarely (for malware with strong anti-sandbox features). But, you wrote in one of your posts that you saw many such samples - this seemed strange to me. Now we know that these samples did not have MOTW, so they were not analyzed in the CyberCapture sandbox.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 984803, member: 32260"] The CyberCapture sandbox was not triggered: [ATTACH type="full" alt="1650359464158.png"]265993[/ATTACH] [URL unfurl="true"]https://support.avast.com/en-us/article/Antivirus-CyberCapture-FAQ/[/URL] CyberCapture can recognize that the file was downloaded from the Internet when the file has got MOTW. One can force CyberCapture to use the sandbox for any EXE file by adding the MOTW. This is done for example by Hard_Configurator or RunBySmartscreen. In theory, the malware can be undetected by the CyberCapture sandbox, but this happens very rarely (for malware with strong anti-sandbox features). But, you wrote in one of your posts that you saw many such samples - this seemed strange to me. Now we know that these samples did not have MOTW, so they were not analyzed in the CyberCapture sandbox.(y) [/QUOTE]

Verification