Havex Malware

[Tuomo]

Hi all,

Do you have any information about PAN detection capability for the Havex malware family: http://www.f-secure.com/weblog/archives/00002718.html

Threat vault seems to produce no hits at the moment.

Tuomo

[ITInfraNL]

I would like more information on this too.

Nick

[pulukas]

This is not showing up yet in the threat vault as an existing update for PA.

https://threatvault.paloaltonetworks.com/

You can open a ticket with support to get a more specific update.

[PANUser-1234]

Did you got some more information about havex/oldrea malware coverage in the threat signatures unitl now?

Andy

[LCMember2327]

Any update from PA?

[Dulle]

While we wait for Palo Alto to wake up; please have a look at these:

http://www.symantec.com/connect/blogs/dragonfly-western-energy-companies-under-sabotage-threat

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threa...

-=Tommy=-

[pulukas]

If this is a critical vulnerability to you, I would open a ticket. This will get the signature escalated internally.

You can't expect an official update from PA here.  These are just user to user support forums.  We are lucky that many PA employees spend a great deal of time here.  But official support is still via tickets to the support portal.

[Dulle]

But we have.....

[ericgearhart]

Looks like Havex made it into the ThreatVault:

https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719

[ericgearhart]

Interestingly enough if you click on the hash links, PA's own WildFire flags it as benign! Hmph. :smileyplain:

[pulukas]

I guess that is just a one way conversation, wildfire pushes signatures to threats but not back the other way.

They did just add this because I checked before posting this morning earlier and it wasn't there yet.

[pivvre]

We uploaded a sample of havex to Wildfire ca June 20th - problem is they don't check it on Acrobat reader 10.x....
PAN also need to update their Virtual machines...

[hyadavalli]

Hello All,

We have coverage for Havex malware.

Please upgrade to latest Anti virus version released today.

Regards,

Hari Yadavalli

[ericgearhart]

Does WildFire flag a sample as malicious yet :smileylaugh:

[hyadavalli]

Based on the SHA provided in initial comment I see wildfire reported as malicious