bvasilev's profile
 Superstar

 Superstar

 • 

181 Messages

 • 

7.2K Points

Sat, Feb 6, 2021 9:38 PM

Trend Micro Reclassifies Malware Links as Safe.

Greetings,

I was going to report this issue a while ago and feel now is the right time.

There is a reclassification portal where business and home users can submit reclassification requests.

The issue here is that it reclassifies links leading to malware payload as safe quite frequently.

The latest instance of this occurrence was minutes ago.

I have submitted a request to reclassify a link I have extracted from malicious Aggah/Haggah script, which is this (please see highlighted in screenshot):

The link allows the downloader to obtain a secondary payload, in this case AsyncRAT.

About 10 minutes later, I got an email back that the site is categorised as safe and associated with computers/internet.

Apparently my comment on where I got the site from and why it is dangerous hasn't been read, but rather the site has been scanned for viruses (the payload is not detected and so is the original script).

Responses

Accepted Solution

Brand User

Legend

 • 

739 Messages

 • 

10.2K Points

7 m ago

Hi bvasilev,

 

Just an update about this, the website has been reclassified as a disease vector.

 

- TM_Reine

bvasilev

 Superstar

 • 

181 Messages

 • 

7.2K Points

Thanks reine_roque.

In relation to the website itself, I have published an article, which anyone can read.

It's available here:
https://malwaretips.com/threads/ratting-the-rat-deep-dive-into-gorgon-group-modus-operandi.106677/
Brand User

Legend

 • 

739 Messages

 • 

10.2K Points

You're welcome bvasilev, thank you for sharing this information.

 

- TM_Reine

Brand User

Legend

 • 

739 Messages

 • 

10.2K Points

7 m ago

Hi bvasilev,

 

For clarification, where did you submit the reclassification request, and what link was submitted? is  it - (hxxps:// z . zz . ht / nbfsn . jpg)

 

I'll also submit this link internally so we can verify the category again. 

 

- TM_Reine

bvasilev

 Superstar

 • 

181 Messages

 • 

7.2K Points

(edited)

Brand User

Legend

 • 

739 Messages

 • 

10.2K Points

Thanks for clarifying, will resubmit it and update you. 

 

- TM_Reine