topic Re: Malicious File in Cloud Networking Platform

Malicious File

Fire_Dragon — Fri, 06 Apr 2018 00:16:22 GMT

I was looking at some security events in my Meraki dashboard and it seems to be showing this malicious filename: W32.4E846BBEDE-95.SBX.TG when I visit the virus total link attached to this finding it gives me different information. I have googled this malicious filename and found that it was linked to a malicious Microsoft Powerpoint exe file. What I am trying to gather here is what exactly does this virus do to the system? Any information would help.

Thanks!

https://www.virustotal.com/en/file/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36/analysis/

Re: Malicious File

simple818 — Fri, 06 Apr 2018 00:56:55 GMT

Were there any other details? I googled that filename and didn't find anything.

Re: Malicious File

Fire_Dragon — Fri, 06 Apr 2018 01:01:59 GMT

Same here I looked everywhere and could not find anything on it. The virus total link I posted at the bottom said Roblox as the file name. I looked up this hash associated with the file 4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36 and got this.

https://www.hybrid-analysis.com/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36

Hope this helps.

Re: Malicious File

Zedilt — Fri, 06 Apr 2018 07:56:16 GMT

Microsoft classifies it as a PUA:Win32/InstallCore,

Summary

This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:

Adds files that run at startup
Modifies file associations
Injects into other processes on your system
Injects into browsers
Changes browser settings
Changes browser shortcuts
Installs browser extensions
Disables User Access Control (UAC)

These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.

If you were trying to install an application, you might have downloaded it from a source other than the official product's website.

We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:

United States
Brazil
France
Poland
Spain

Source

Re: Malicious File

Fire_Dragon — Fri, 06 Apr 2018 13:07:21 GMT

Thank you for your help 🙂