Report trusted and whitelisted malware here- 2017 (NO LIVE MALWARE!)

Previous Thread

Comodo is constantly improving its whitelist. This makes CIS more user friendly but does, in some circumstances, have some downsides. Some malware may sometimes be trusted because it is signed by a trusted certificate or perhaps the vendor was trustworthy, but then changed their ways. This is rare, but it does happen.

Regardless of how it happens it’s important to take action against this. If you find malware that is whitelisted, but seems suspicious, please report it here. The name of the trusted vendor, or any other information, is also useful.

Upload these files to one of the following services and post a link to the results:

Comodo Instant Malware Analysis
or Comodo Valkyrie
or VirusTotal

DO NOT attach or link any malware or malicious links to your post.

When coming across a malware signed by Comodo please follow the steps as described in How to report fraudulent or malicious use of certificates issued by Comodo:

Code Signing Certificates

If you have come across malware signed with a Comodo issued Code Signing certificate please send as much detail as possible to:

signedmalwarealert[at]comodo.com

Helpful details include:
link to the signed malware
screenshots of the certificate details showing the signer organization or certificate serial number or other details which will help us identify the certificate
a copy of the actual certificate if possible

This article also describes how to report fraudulent and phishing emails using Comodo SSL/TLS certificates (but this is not pertinent for this topic).

Trojan.Generic

Important Information : This malicious File was signed with a VALID Certificate from Comodo !!!

Some suspicious Indicators : Anti-vm present (checks Version of Bios and queries Information about Disks) , Multiple malicious artifacts seen in the context of different hosts , Opens the Kernel Security Device Driver (KsecDD) of Windows , Collects Information to fingerprint the System

Hi pio,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Regards,
Pavithran G

is not Malware

Hi,

Thank you for your submission.
We’ll check them.

Kind Regards,
Erik M.

Hi a77841s,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Regards,
Pavithran G

Hi a77841s,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Regards,
Pavithran G

Why SpyShelter keylogger test tool has been whitelisted?
Then, it makes no sense to use it for testing… it’s like to whitelist the EICAR test file…

https://www.spyshelter.com/download/AntiTest.zip

Hello Jon79,

The sample you have provided is not whitelisted.

Best regards,
FlorinG

I run it on CFW 10.0.0.6086 and it wasn’t auto-sandboxed, then I checked the rating and it was “trusted”

e40306d8dc24f9987fb4f8e5a4372baa4d88c74c
b9f2414d2cd8473edc30e86c6d250cfff64cc58d
5f39d325a6ca052b98170087042ef189ce10f235
dc329869c0219b45e31b2561fced5a2e096fb137

Hi ya.q1,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Best regards
Qiuhui.■■■■

26e787997a338d8111d96c9a4c103cf8ff0201ce

Hello Wisdom,
Thanks for your submission. We’ll check the sample you submitted and add detection if necessary.
Best regards,
Andrei Savin

this exe can kill any process. This is dangers.

Hi a77841s,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Regards,
Pavithran G

e40306d8dc24f9987fb4f8e5a4372baa4d88c74c

Hi,
Thanks for your submission.
We’ll check it and add detection if necessary.

Best regards,
Andrei Savin