topic Re: Havex Malware in General Topics

Havex Malware

Tuomo — Tue, 24 Jun 2014 10:47:34 GMT

Hi all,

Do you have any information about PAN detection capability for the Havex malware family: http://www.f-secure.com/weblog/archives/00002718.html

Threat vault seems to produce no hits at the moment.

Tuomo

Re: Havex Malware

ITInfraNL — Fri, 27 Jun 2014 08:51:35 GMT

I would like more information on this too.

Nick

Re: Havex Malware

pulukas — Sat, 28 Jun 2014 00:10:50 GMT

This is not showing up yet in the threat vault as an existing update for PA.

https://threatvault.paloaltonetworks.com/

You can open a ticket with support to get a more specific update.

Re: Havex Malware

PANUser-1234 — Wed, 02 Jul 2014 05:36:37 GMT

Did you got some more information about havex/oldrea malware coverage in the threat signatures unitl now?

Andy

Re: Havex Malware

LCMember2327 — Wed, 02 Jul 2014 07:25:20 GMT

Any update from PA?

Re: Havex Malware

Dulle — Wed, 02 Jul 2014 07:41:53 GMT

While we wait for Palo Alto to wake up; please have a look at these:

http://www.symantec.com/connect/blogs/dragonfly-western-energy-companies-under-sabotage-threat

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf

-=Tommy=-

Re: Havex Malware

pulukas — Wed, 02 Jul 2014 11:17:41 GMT

If this is a critical vulnerability to you, I would open a ticket. This will get the signature escalated internally.

You can't expect an official update from PA here. These are just user to user support forums. We are lucky that many PA employees spend a great deal of time here. But official support is still via tickets to the support portal.

Re: Havex Malware

Dulle — Wed, 02 Jul 2014 11:35:39 GMT

But we have.....

Re: Havex Malware

ericgearhart — Wed, 02 Jul 2014 11:46:27 GMT

Looks like Havex made it into the ThreatVault:

https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719

Re: Havex Malware

ericgearhart — Wed, 02 Jul 2014 11:47:49 GMT

Interestingly enough if you click on the hash links, PA's own WildFire flags it as benign! Hmph. :smileyplain:

Re: Havex Malware

pulukas — Wed, 02 Jul 2014 11:51:26 GMT

I guess that is just a one way conversation, wildfire pushes signatures to threats but not back the other way.

They did just add this because I checked before posting this morning earlier and it wasn't there yet.

Re: Havex Malware

pivvre — Wed, 02 Jul 2014 11:54:21 GMT

We uploaded a sample of havex to Wildfire ca June 20th - problem is they don't check it on Acrobat reader 10.x....
PAN also need to update their Virtual machines...

Re: Havex Malware

hyadavalli — Wed, 02 Jul 2014 15:05:18 GMT

Hello All,

We have coverage for Havex malware.

Please upgrade to latest Anti virus version released today.

Regards,

Hari Yadavalli

Re: Havex Malware

ericgearhart — Wed, 02 Jul 2014 15:25:00 GMT

Does WildFire flag a sample as malicious yet :smileylaugh:

Re: Havex Malware

hyadavalli — Wed, 02 Jul 2014 15:49:28 GMT

Based on the SHA provided in initial comment I see wildfire reported as malicious

Re: Havex Malware

ericgearhart — Wed, 02 Jul 2014 16:04:42 GMT

Re: Havex Malware

hyadavalli — Wed, 02 Jul 2014 16:54:55 GMT

I only see one SHA reported as malware and rest as benign.

Please open a case with palo alto support and they'll address the issue with wildfire.

Re: Havex Malware

ericgearhart — Wed, 02 Jul 2014 16:56:57 GMT

I don't have a sample of the malware, I'm just "stirring the pot" to be honest

Re: Havex Malware

pivvre — Thu, 03 Jul 2014 09:42:31 GMT

Interesting info in Brightclouds Webinar on Dragonfly/havex right now,

I asked if there has been any information exchange between Symantec (which has a lot of information - and protect users - on Dragonfly/havex) and Paloalto. They said the did info ex with a lot of company, but not PAN - why not?

Re: Havex Malware

pulukas — Fri, 04 Jul 2014 10:44:18 GMT

hyadavalli,

Based on your responses here, I assume you work for PA. Can you explain what happens with new signatures like this against the existing file database that was deemed benign?

Some of these "benign" files will be previously unknown viruses like Havex. Does Wildfire check them again against new signatures?

If a previously flagged benign file is uploaded again, is this automatically benign from the previous verdict?

In short, how does PA clean up the hash database to be sure the new viruses are successfully identified?