topic Re: Virus/Win32.WGeneric.bhqpnl messages by Saas solution Basware ( approval bulk invoices ) in Advanced Threat Prevention Discussions

Virus/Win32.WGeneric.bhqpnl messages by Saas solution Basware ( approval bulk invoices )

BMuldersVos — Tue, 20 Jul 2021 06:36:23 GMT

Hello everyone,

We had our Citrix environment recently that got flagged in the firewall with this virus. ( after 14-07 ) Virus/Win32.WGeneric.bhqpnl
We have a Saas solution of the product Basware. ( Bulk approval invoices ) We see on the Palo-Alto that an Absent loader ( Malware Dropper ) is seen. The product is working with Silverlight. Also a message came in "Reset-From-Server" when the users download the invoices.

The name of the virus is called : Virus/Win32.WGeneric.bhqpnl and bhmwrs and bhnjtc etc.

Re: Virus/Win32.WGeneric.bhqpnl messages by Saas solution Basware ( approval bulk invoices )

BMuldersVos — Wed, 21 Jul 2021 07:00:10 GMT

Thank you for your explanation. The question now is, is it a false positive or must we go to the vendor for an explanation from their side ?

Re: Virus/Win32.WGeneric.bhqpnl messages by Saas solution Basware ( approval bulk invoices )

Guiseppe — Mon, 26 Jul 2021 05:03:40 GMT

That is completely expected. These are the threat logs written by the Zone Protection Profile (Reconnaisancde Protection) applied to the zone "Outside". The source (public IPs) running the SCAN is detected in the outside zone, and the destination IPs (probably the firewall's public IPs) are also assigned to the same zone. Source and destination IPs live in the same zone.

acesetm