Bitdefender support fail

[likeastar20]

Sent the file to BD, they said "We have received an update from our laboratory in which we are informed that the file is clean and currently not detected by our engines.
File 16890524015540_Setup_exe[7a7728a6ed63717026afc70d90780d54] declared CLEAN"

This also contradicts their sandbox behavior. This is the first failure I've seen from BD business support. How did they check the file?

VirusTotal

VirusTotal

www.virustotal.com

shurk | 9de0dfcf9baf669811374d2f6ed0a1182df8d0254cd210f6f2883c659014de5a | Triage

Check this shurk report malware sample 9de0dfcf9baf669811374d2f6ed0a1182df8d0254cd210f6f2883c659014de5a, with a score of 10 out of 10.

tria.ge

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[likeastar20]

@SeriousHoax you use BD iirc? Is it detected by now?

 

[RansomwareRemediation]

contact Bitdefender Chat, they solve it. https://www.bitdefender.com/consumer/support/help/ .

 

[SeriousHoax]

Did you choose false positives instead of false negative by mistake?
Besides that, I had a couple of situations where I got a wrong reply like this one while they actually created a signature. The replies are written by support staff and they sometimes make mistakes.
I'll check if BD detects it. Btw, you can reply to that email, add details like why it's a malware, include Virustotal links, etc details like that. The support staff will forward that to the malware analysts and they will check the sample again. I have done this in the past.
Or contact chat as @RansomwareRemediation suggested.

 

[likeastar20]

Did you choose false positives instead of false negative by mistake?
Besides that, I had a couple of situations where I got a wrong reply like this one while they actually created a signature. The replies are written by support staff and they sometimes make mistakes.
I'll check if BD detects it. Btw, you can reply to that email, add details like why it's a malware, include Virustotal links, etc details like that. The support staff will forward that to the malware analysts and they will check the sample again. I have done this in the past.
Or contact chat as @RansomwareRemediation suggested.

I replied to their email, let's see what they say. I still don't see any detection by BD on VT. Maybe you can try to send them the sample?

 

[silversurfer]

VirusTotal

VirusTotal

www.virustotal.com

After downloading this sample, I just did a quick test in my VM with installed BD Free, successfully blocked after running a few seconds, Detection ID: SuspiciousBehavior...

 

[SeriousHoax]

After downloading this sample, I just did a quick test in my VM with installed BD Free, successfully blocked after running a few seconds, Detection ID: SuspiciousBehavior...

View attachment 277055View attachment 277056

I got this on BD Free:

 

[likeastar20]

After downloading this sample, I just did a quick test in my VM with installed BD Free, successfully blocked after running a few seconds, Detection ID: SuspiciousBehavior...

View attachment 277055View attachment 277056

Still not a proper signature, just the behavior blocker doing it's job.

 

[silversurfer]

Still not a proper signature, just the behavior blocker doing it's job.

I haven't said otherwise as usual called "suspicious behavior" or similar one "generic...." always at first when the ATP (Advanced Threat Defense) does block unknown samples.
I have seen that for more than 100 times while testing BD Free. We will see if Bitdefender's professional analysts does add a more "proper detection name"

 

[likeastar20]

I haven't said otherwise as usual called "suspicious behavior" or similar one "generic...." always at first when the ATP (Advanced Threat Defense) does block unknown samples.
I have seen that for more than 100 times while testing BD Free. We will see if Bitdefender's professional analysts does add a more "proper detection name"

Did you send the sample?

 

[silversurfer]

Did you send the sample?

Not for now, usually BD does collect all related file hashes, so even your shared "source" sample should be known to them after ATP blocked/detected.

 

[Trident]

We have received an update from our laboratory in which we are informed that the file is clean and currently not detected by our engines.

You may have chosen by mistake “false positive” on the submission form. Support scanned the file quickly, saw there is no definition and closed the case.

 

[likeastar20]

You may have chosen by mistake “false positive” on the submission form. Support scanned the file quickly, saw there is no definition and closed the case.

Could be a possibility, that's why I'm waiting for someone else to send the sample and see

 

[silversurfer]

Could be a possibility, that's why I'm waiting for someone else to send the sample and see

Okay I will do soon, where did you submit this sample directly to BD support email or via this link? https://www.bitdefender.com/business/submit/

 

[likeastar20]

Okay I will do soon, where did you submit this sample directly to BD support email or via this link? https://www.bitdefender.com/business/submit/

The link

 

[likeastar20]

@Trident

 

[likeastar20]

@Trident @silversurfer @SeriousHoax @RansomwareRemediation So it was a failure by them, similar to this topic:Malware Analysis - Malware/PUA listed as clean (again)

 

[silversurfer]

@Trident @silversurfer @SeriousHoax @RansomwareRemediation So it was a failure by them, similar to this topic:Malware Analysis - Malware/PUA listed as clean (again)

View attachment 277060

Confirmed, they sent to me almost same email from BD support team:

 

[likeastar20]

Confirmed, they sent to me almost same email from BD support team:

View attachment 277061

Detection added. It was a good thing that the Behavior Blocker and the Network Shield were able to block the sample