Malware Analysis Malware/PUA listed as clean (again)

[Sandbox Breaker - DFIR]

Found this at a customer. It was blocked but upon further inspection I saw that Xcitium marks the files as clean. Their human analyst also concluded its clean. ITS NOT.

Xcitium Cloud Verdict

Scan Files Online using Comodo File Verdict Service that runs tens of different methods to analyze a file and display the detailed results in seconds

verdict.xcitium.com

VirusTotal

VirusTotal

www.virustotal.com

 

[Kongo]

Found this at a customer. It was blocked but upon further inspection I saw that Xcitium marks the files as clean. Their human analyst also concluded its clean. ITS NOT.

Xcitium Cloud Verdict

Scan Files Online using Comodo File Verdict Service that runs tens of different methods to analyze a file and display the detailed results in seconds

verdict.xcitium.com

VirusTotal

VirusTotal

www.virustotal.com

Could you share the sample please?

 

[Sandbox Breaker - DFIR]

Could you share the sample please?

With pleasure. Triage | Malware sandboxing report by Hatching Triage

 

[Shadowra]

Detected by CheckPoint Harmony ( Trojan.Win32.Agent.xataeo )



DeepInstinct too

 

[Sandbox Breaker - DFIR]

Detected by CheckPoint Harmony ( Trojan.Win32.Agent.xataeo )

View attachment 276675

DeepInstinct too

View attachment 276676

Of course they are! Haha

 

[Trident]

Detected by CheckPoint Harmony ( Trojan.Win32.Agent.xataeo )

View attachment 276675

DeepInstinct too

View attachment 276676

What does it say under reputation in the forensic report?

 

[Kongo]

ITS NOT.

Yup. Kinda sad that an "expert" can't determine that it's unsafe. And he even gets money for his work.

 

[Sandbox Breaker - DFIR]

Yup. Kinda sad that an "expert" can't determine that it's unsafe. And he even gets money for his work. Industry needs real analysts like us

 

[Trident]

Yup. Kinda sad that an "expert" can't determine that it's unsafe. And he even gets money for his work.

There is no human analysis. This is a browser hijacker, there is no way a real human won’t see that. And it’s also an old one. The human analysis is just marketing.

 

[Sandbox Breaker - DFIR]

There is no human analysis. This is a browser hijacker, there is no way a real human won’t see that. And it’s also an old one. The human analysis is just marketing.

That's a disgrace.

There is no human analysis. This is a browser hijacker, there is no way a real human won’t see that. And it’s also an old one. The human analysis is just marketing.

They are also still using the sample. Wierd how a two month old file is still being distributed.

 

[Shadowra]

What does it say under reputation in the forensic report?

Trojan

 

[Kongo]

They are also still using the sample. Wierd how a two month old file is still being distributed.

Same as the stealer malware I shared in another thread. And it's actually more than 6 months old according to VT.

 

[Sandbox Breaker - DFIR]

Same as the stealer malware I shared in another thread. And it's actually more than 6 months old according to VT.

Mind blow.

 

[partha_roy]

HAs anyone tried to execute this on a virtual machine or a sandboxed state, with the AV disabled, just to check what it does?

 

[Trident]

View attachment 276677

Trojan

This one would be detected both with Kaspersky and Sophos engines.

@partha_roy it is a browser hijacker, it was mentioned above.

 

[Sandbox Breaker - DFIR]

HAs anyone tried to execute this on a virtual machine or a sandboxed state, with the AV disabled, just to check what it does?

147e1b5a750fbfd8863449d523e3d6d110defceb74ad9cdb7c939ab75ffa2180 | Triage

Check this report malware sample 147e1b5a750fbfd8863449d523e3d6d110defceb74ad9cdb7c939ab75ffa2180, with a score of 8 out of 10.

tria.ge

You can see the report here.

This one would be detected both with Kaspersky and Sophos engines.

@partha_roy it is a browser hijacker, it was mentioned above.

The malware family is "Agent". Funny. Kaspersky sig

 

[partha_roy]

This one would be detected both with Kaspersky and Sophos engines.

@partha_roy it is a browser hijacker, it was mentioned above.

Right, that's what it says but did anyone actually see it in action? Just curious

 

[Trident]

The malware family is "Agent". Funny. Kaspersky sig

Agent refers to any malware that is not significant enough to have its own family. It is an industry standard. The file has dual detection, one is Check Point proprietary and one is Kaspersky’s feeds.

 

[Shadowra]

HAs anyone tried to execute this on a virtual machine or a sandboxed state, with the AV disabled, just to check what it does?

It starts an installation and closes

 

[partha_roy]

It starts an installation and closes

Okay, so perhaps that is why Comodo isn't classifying it as malicious because it isn't doing anything harmful..