Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 977540" data-attributes="member: 83059">[USER=91446]@Anthony Qian[/USER] first mentioned something along these lines and I started doing a little testing of new Emotet/Snake samples.... In the past, zero-day detections usually come from HEUR/APC (Avira cloud). But recently, F-Secure is detecting them using &quot;!fsmind&quot; signatures, like &quot;Trojan:W32/Generic.abch!fsmind&quot; or &quot;Backdoor:W32/Androm!fsmind_tc&quot;These appear to be unique to F-Secure and my best guess is that &quot;fsmind&quot; is the new replacement for &quot;fso&quot;/F-Secure Online. Is F-Secure no longer using Avira Protection Cloud? Anyone seen APC detections recently?(I did confirm that &#039;fsmind&#039; detections do not trigger when offline so it&#039;s definitely some sort of cloud based detection).As an aside: VirusTotal&#039;s F-Secure is offline-only, these samples show up as clean on VT but the actual F-Secure product detects it statically.</blockquote>

[QUOTE="MacDefender, post: 977540, member: 83059"] [USER=91446]@Anthony Qian[/USER] first mentioned something along these lines and I started doing a little testing of new Emotet/Snake samples.... In the past, zero-day detections usually come from HEUR/APC (Avira cloud). But recently, F-Secure is detecting them using "!fsmind" signatures, like "Trojan:W32/Generic.abch!fsmind" or "Backdoor:W32/Androm!fsmind_tc" These appear to be unique to F-Secure and my best guess is that "fsmind" is the new replacement for "fso"/F-Secure Online. Is F-Secure no longer using Avira Protection Cloud? Anyone seen APC detections recently? (I did confirm that 'fsmind' detections do not trigger when offline so it's definitely some sort of cloud based detection). As an aside: VirusTotal's F-Secure is offline-only, these samples show up as clean on VT but the actual F-Secure product detects it statically. [/QUOTE]

Verification