Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1089075" data-attributes="member: 32260">The sample from the OP is probably the payload delivered by another malware (parent malware), like:[URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007[/URL]It is interesting if that sample was blocked by the ASR rule. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />I think that although the sample from the OP was initially undetected by Microsoft Defender after 24 hours (false negative), it is probable that the parent malware was blocked by the ASR rule by low prevalence (if it was not detected by Microsoft Defender). Next, someone submitted the payload to Microsoft, so it is currently detected.</blockquote>

[QUOTE="Andy Ful, post: 1089075, member: 32260"] The sample from the OP is probably the payload delivered by another malware (parent malware), like: [URL unfurl="false"]https://www.virustotal.com/gui/file/78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007[/URL] It is interesting if that sample was blocked by the ASR rule. :unsure: I think that although the sample from the OP was initially undetected by Microsoft Defender after 24 hours (false negative), it is probable that the parent malware was blocked by the ASR rule by low prevalence (if it was not detected by Microsoft Defender). Next, someone submitted the payload to Microsoft, so it is currently detected. [/QUOTE]

Verification