Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 996627" data-attributes="member: 32260">Unfortunately, your procedure is not valid for testing BAFS:<ol>
<li data-xf-list-type="ol">If the MSI file is submitted, we do not know if it is going to be tested immediately in the sandbox. So, you cannot expect that the BAFS detection will work after several minutes.</li>
<li data-xf-list-type="ol">The file is scanned once just after the download. So, you have to download it again after several minutes to trigger BAFS.</li>
</ol>The proper way (in a Virtual Machine) is to run the malware, and wait until it will infect the machine. Next, use another snapshot, and download the malware after several minutes. The sample must be downloaded directly as the MSI file (cannot be embedded in the ISO, 7-ZIP,&nbsp; etc.).This chart shows the spread of Magniber and not the confirmed infections. Furthermore, the chart can be related to&nbsp; 360 antivirus detections.[URL unfurl=&quot;true&quot;]https://blog.360totalsecurity.com/en/win11-users-beware-magniber-ransomware-has-been-upgraded-again-aiming-at-win11/[/URL]By any means, it does not show confirmed infections of Microsoft Defender users.</blockquote>

[QUOTE="Andy Ful, post: 996627, member: 32260"] Unfortunately, your procedure is not valid for testing BAFS: [LIST=1] [*]If the MSI file is submitted, we do not know if it is going to be tested immediately in the sandbox. So, you cannot expect that the BAFS detection will work after several minutes. [*]The file is scanned once just after the download. So, you have to download it again after several minutes to trigger BAFS. [/LIST] The proper way (in a Virtual Machine) is to run the malware, and wait until it will infect the machine. Next, use another snapshot, and download the malware after several minutes. The sample must be downloaded directly as the MSI file (cannot be embedded in the ISO, 7-ZIP, etc.). This chart shows the spread of Magniber and not the confirmed infections. Furthermore, the chart can be related to 360 antivirus detections. [URL unfurl="true"]https://blog.360totalsecurity.com/en/win11-users-beware-magniber-ransomware-has-been-upgraded-again-aiming-at-win11/[/URL] By any means, it does not show confirmed infections of Microsoft Defender users. [/QUOTE]

Verification