Malware.AI.1254230990

[bjm]

https://www.virustotal.com/gui/file/4ac9d22dc556e4d485c8a1e46fd556311605d4d4ab414a24ed7ca19211fb811a/detection

Please confirm AI detection.
Thanks

Malware.AI.1254230990.txt tomb4.zip

[miekiemoes]

Thanks.

This will be reviewed and fixed if needed.

[bjm]

Please advise has AI detection been fixed?....remains under review?

Malwarebytes static scan
Version: 4.3.0.98
Components Version: 1.0.1217
Update Package Version: 1.0.38351
License: Premium
Objects Scanned: 1
Threats Detected: 0

File: tomb4.exe
File size: 1.77 MB (1,851,392 bytes)
MD5 checksum: 1D97D0BDE7A64CB81DEB31F547B471A1
SHA1 checksum: 403522D7E43F9508D082F5B83ACDBFC4FA5F312D
SHA256 checksum: 4AC9D22DC556E4D485C8A1E46FD556311605D4D4AB414A24ED7CA19211FB811A

My understanding is that VirusTotal uses the command-line scanner versions of the products that support VirusTotal. Some of the solutions included in VirusTotal are configured according to the parameters requested by the vendor, with a more aggressive level of heuristic detection than the official end-user default configuration would offer. 

[bjm]

Please confirm Malware.AI.1254230990 detection (consumer product) has changed. 

Thank you

 

 

[miekiemoes]

Please share the sample (if new) and detection log, as above isn't being detected anymore locally.

[bjm]

Yes, (same) sample is not detected locally.

Version: 4.3.0.98
Components Version: 1.0.1217
Update Package Version: 1.0.38391
License: Premium
Objects Scanned: 1
Threats Detected: 0

[Porthos]

41 minutes ago, bjm said:

Yes, (same) sample is not detected locally.

You are correct about the following.

20 hours ago, bjm said:

My understanding is that VirusTotal uses the command-line scanner versions of the products that support VirusTotal. Some of the solutions included in VirusTotal are configured according to the parameters requested by the vendor, with a more aggressive level of heuristic detection than the official end-user default configuration would offer. 

Malwarebytes has no control on the Virus Total results. They usually change (get removed) after several days.

[bjm]

5 minutes ago, Porthos said:

You are correct about the following.

Malwarebytes has no control on the Virus Total results. They usually change (get removed) after several days.

Okay....regarding "no control on the Virus Total results".

My understanding .... Malwarebytes command-line engine employs different configuration and detection techniques/heuristics which might detect more than the commercial product. Malwarebytes employs false-positive suppression mechanisms in the commercial product which are not present in the Virus Total command-line engine.

With my opening post Malware.AI.1254230990 detection was reported with my Malwarebytes commercial product, as with Virus Total.  
So, either AI detection evolved over time or Malwarebytes manually changed detection with commercial product.  

Thanks

 

[Porthos]

4 minutes ago, bjm said:

So, either AI detection evolved over time or Malwarebytes manually changed detection with commercial product.  

This is correct. The installed product is clear now. Because of the "AI" detection, these can fix themselves as the AI adapts.

Edited March 19, 2021 by Porthos