False Positive cheftak.apk

[m_androiddev]

Hello
We produce an application called cheftak and malwarebytes founds that as a Trojans on our client’s phones.

apk file uploaded to virustotal and No engines detected this file. ("https://www.virustotal.com/gui/file/e658b56fbac942dae97ecb5e7849003e8ad3f760fbc782a959b1bc88e66611f6/detection").
Cheftak has high qualities and it's safe to other antivirus apps but unfortunately there is a problem.
Cheftak is similar to apps like applock and we used our ideas and considering copy rights rule in our app.
We are young developers and have developed this app for 2 years and this problem cause a financial
dissater for us just because of 10,000 uninstall of our app.
Cheftak is available at café bazar app with below address:
https://cafebazaar.ir/app/com.cheftak?l=en
We were attach the app(cheftak.zip) for you and have hope for your coresponding answer as soon as possible.

 

 

 

 

 

 

[m_androiddev]

please help us.

[miekiemoes]

Hi,

This will be reviewed and adjusted if needed.

Thanks for reporting!

[mbam_mtbr]

HI @m_androiddev,

Thanks for bringing this to our attention.  This issue has been resolved and will no longer be detected in future database versions.

Thanks again,

Nathan

[m_androiddev]

4 hours ago, mbam_mtbr said:

HI @m_androiddev,

Thanks for bringing this to our attention.  This issue has been resolved and will no longer be detected in future database versions.

Thanks again,

Nathan

thank you very much.
We tested the application again. But unfortunately, he still knows Chaftak as a trojan. When will this problem be fixed on android phones?

[mbam_mtbr]

Hi @m_androiddev,

The change is in Malware Database 2021.02.15.01:

If you are not on this version, I would try to force an update: Manually update database in Malwarebytes for Android

If you're referring to the Ransomware detection, there isn't anything we can do about that.

This warning is from our advanced ransomware scanner.  Apps that have elevated privileges and that have been installed using side loading (anything installed outside of Google Play) are flagged as potential ransomware.

Installation from outside the Play Store plus elevated privileges are big red flags. Therefore, we warn our customers that a suspicious app was installed that displays ransomware like properties. It’s up to the user to ignore our warnings or not.

Ransomware is particularity dangerous, and this warning gives users the ability to cut it off before it’s too late.

Thanks for reaching out,

Nathan

[m_androiddev]

Thank you @mbam_mtbr

Ransomware detection is displayed for the cheftak.apk. But for another application that has not been downloaded from  Play Store and does not even exist in it, There is no problem .We will attach the screen and the scanned file dordaneh_V15_Final.zip for review. Thanks for explaining this.

[mbam_mtbr]

16 hours ago, m_androiddev said:

Thank you @mbam_mtbr

Ransomware detection is displayed for the cheftak.apk. But for another application that has not been downloaded from  Play Store and does not even exist in it, There is no problem .We will attach the screen and the scanned file dordaneh_V15_Final.zip for review. Thanks for explaining this.

This is because dordaneh_V15_Final doesn't elevated privileges.  Thus, it's not a threat of being ransomware.

Nathan