PUA detected: 'SpiGot'

Hi Amit Thakur,

Could you help me with the Sophos product that you are using?

As already mentioned, there was a new definition update pushed on 29th Sep for a similar/same file (You can verify the file from the VirusTotal link). This new definition classifies the file as PUA, which could have resulted in multiple detections over the endpoints. Sophos Clean should have been able to clear it

HI Mani,

1. If suppose any updates are being pushed from Sophos end that caused this alert so why not it is coming in other environment where we are using Sophos or why still the alerts are with limited numbers because we are supporting 7000+ machines in client environment but only 150 machines showed this PUA. So did the next update from Sophos have stopped this adware from spreading. if yes than how the updates work in Sophos?

2. If the updates have been pushed will it going to differ for both Intercept X for servers & Windows?

3. Do we have any article stating from Sophos that the PUA alert 'SpiGot' is a false positive?

Kindly, help me here to find the answers for the above queries

Thanks

Hi Amit Thakur,

We have not yet concluded if these detections are caused by the latest Definitions (It is just one of the possibilities). Also, even if the definitions are causing the detections unless all the clients have the exact same file (With Same Hash) we necessarily not see the detection on all the endpoints.

The level of protection will be the same for Server and endpoints, the definitions should detect the threats irrespective of the server or client.

As mentioned earlier it would be better if have a support ticket open to investigating it. If you believe it could be a false positive, we can have it investigated.

Hello participants,

please note:
If you believe it could be a false positive
a sample of the file(s) that triggered a supposedly incorrect detection is required - names, paths, number and time of incidents are not sufficient.

Christian

I submitted the sample to Sophos and waiting for response. This could be false positive as even we see lot of deetctions from two days.

I submitted the sample to Sophos and waiting for response. This could be false positive as even we see lot of deetctions from two days.

Please do let me know what Sophos have to say about the file

Hello Amit Thakur,

the file
that Ravi Chandra sent in (assuming the files are identical on all endpoints) isn't necessarily the one (same assumption) that has been found on your endpoints. Whatever Sophos has to say might or it might not apply to your situation.

Christian

I have many PC's also detecting this it is either coming from after.js or background.js

AppData\Local\Google\Chrome\User Data\Default\Extensions\dhleoaffpledanfnonifcgfgabmkgepp\2.1_0\after.js

AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dchmajdpafbhfjocfoofjlglgpbolalj\2.0_0\background.js

Sophos said that they are seeing more events than expected originally. They might have got complaints from other customers also. The solution they gave is that the files after.js and background.js are related to "Simple Converter" and Sophos is blocking as PUA which is usual. I think it's a true positive but incorrectly categorized from the response I got. So, we need to either authorize or cleanup the files.

I did not get much information on this "simple converter" for which I am waiting response from Sophos.

As Christian said it could be different if you see the detections in other paths rather than google chrome extensions. If its in extension and files are same then the solution will be same.

Hello Ravi,

Am just another individual who's been a victim of a retarded product. So, what'd Sophos say about the SpiGot malware? False positive as usual?

Sophos advised that it's a PUA and to authorize it if needed. But I did not authorize and left it as it is since it's a browser extension related to fast maps.

Browser extension related to "search.hfastmapfinder.com" found in one of the machine's manifest.json file but not sure how its related to Spigot. I raised this question but Sophos keep saying the detection is correct.