topic Re: Malware being reported under Threats in Network Security

Malware being reported under Threats

pmcamilleri — Tue, 12 Mar 2019 11:20:27 GMT

Dear all

Recently our Cisco 5512-X was recently upgraded to FirePOWER services and I am trying to familiarize myself with this new software. When looking at the Threats section (ASA FirePOWER Reporting) I am seeing that Malware has been detected. See attached screenshot. However, there is no way to find out what caused this alert and from where it originated from i.e. source ip, etc I cannot dig deeper because I am not given much to work on. Is there any way one can find out from where this malware originated from? Could someone guide me on this? Management of FirePOWER is being done via ASDM which is on version 7.8(2)151.

Thanks in advance

Pierre

Re: Malware being reported under Threats

Sheraz.Salim — Tue, 29 Jan 2019 11:39:37 GMT

This malware already being discussed in this community.

here is the link for this

https://community.cisco.com/t5/intrusion-prevention-and/malware-cnc-win-trojan-pmabot-outbound-connection-attempt-etc/td-p/2926914

Re: Malware being reported under Threats

pmcamilleri — Tue, 29 Jan 2019 11:45:07 GMT

I've accessed the link but it doesn't answer my query or solve my issue. I need to know how to delve deeper in order to see from where this malware is originating from such as source IP, etc.