False positive? GT:JS.Hyena.3 detections

[Chris05]

Last night we started getting GT:JS.Hyena.3.x detections on a number of computers. We are continuing to receive them, over 150 machines so far. Anyone else seeing this? 

[Leedr]

Any news about this potential FP? Also seeing an alert in Cloud gateway system coming from to a legitimate travel site "Volaris.com". See details:

Malware Name: GT:JS.Hyena.3.45B1BCCE

Malware Type: Virus

Malware Severity: high

Malware ID: 8f776ae162e453ad2f04bc6370f2eab3

[MidwestCyber]

I have heard no update, but detections seemed to halt in our environment around 0300 CDT. Holding until official announcement.

[Matthew Franks]

The signature has been removed to be re-evaluated, so once signatures update on your endpoints, the FP should be resolved.

[miguel-alegria]

Do you have the signature number that was removed? I have several installation errors with the same signature number, and I would like to know if they are related.

[Matthew Franks · Accepted solution]

The signature number was 14081197 and it was updated on the 10th around 2300 UTC. Hope that helps.

-Matt