Rebe1l Malware Was Not Detected By Sophos - Customer Said

RE: Rebe1l Malware Was Not Detected By Sophos - Customer Said

Sophos User930 — Mon, 05 Jul 2021 11:31:03 GMT

Given the info here for that hash:

VirusTotal

2021-03-17 11:13:21 UTC - 3 months ago

Re-evaluating it now: "2021-07-05 11:25:55 UTC - 1 minute ago"

It still only has 3 vendors, Crowdstrike naming has it down as "Win/malicious_confidence_60% (W)"

Where are they getting the info that the sample is malicious? The site quoted?

RE: Rebe1l Malware Was Not Detected By Sophos - Customer Said

James Olorunosebi — Mon, 05 Jul 2021 10:47:53 GMT

Hello GlenSen,

Customer is unable to find the file anymore, but says he has the hash. Would this information suffice? It is publicly accessible as well on this link:

threatinfo.net/.../rebe1l.exe-d841ab02340b04b05a6e665ce7f78975

RE: Rebe1l Malware Was Not Detected By Sophos - Customer Said

GlennSen — Mon, 05 Jul 2021 00:27:07 GMT

Hi There,

Thank you for reaching us, can you confirm if the customer uses the recommended settings from Sophos which being described here.

Also, do you still have the sample for the said malware? Can you submit the said sample through our sample submission portal in order for our labs' team to check and validate the said sample? You may follow this KB article on how to submit a sample.