identify ExtraDAT version

[HoangCuong]

Please define for me the version of ExtraDAT covered the sample below in service requests 4-21556909221. MD5 e31ab9388cbaa8750516d38088dddbb0 SHA-1 d190aea4ac58975d98e657674ae6a80cba5c6b08 SHA-256 af6cb7f9aaa2e1cff577888164f689c4bdb62490bd78915595d7fdd6462d09c4

[yaz]

Hi @HoangCuong 

Thanks for reaching out to community.

From the details of the hash, I see this is covered and detected as "BackDoor-PlugX!E31AB9388CBA ".

I see you have raised SR as MALWARE submission that goes to labs.

I request you to reach out to us as normal submission mechanism so that we can check details accordingly. 

Was my reply helpful?

If yes, please give me a Kudo. If this resolves your query, Kindly Mark this as solution so that together we help other community members.

[yaz]

Hi @HoangCuong 

This file does not show any malicious behavior on the sandboxing.

We dont have detection for this file. 

Kindly let me know if you have any further queries. 

Was my reply helpful?

If yes, please provide me with a kudo. If I have answered your query, then kindly mark this as solution so that together we help other community members 

[HoangCuong]

Hi @yaz,

Please extract this file with winrar and try analysis again.

I my case, The malware was detected and blocked by ATP. However, I want to update ExtraDAT to automatically remove this file on the system.

[yaz]

Hi @HoangCuong 

I request you to open an SR in this regards so that we can see what is the root cause.