Bypass XCS by creating high-risk items in the startup entry

Product Discussions XCS - Xcitium Client Security
1

This issue was originally reported in the COMODO forum. Here is the link.

https://forums.comodo.com/t/bypass-cis-build-8088-by-creating-high-risk-items-in-startup-entry/359952

According to the test, this bypass may also exist in the XCS. Since I don’t have an Xcitium account to install the XCS for testing, you can test it on your end.

2

Hi @Redstraw

I will share the details with the verdict team and look into it. Could you please share the sample sha1 details to us .

3

@nivedithab

MD5: 9cf2c793029ae8dd84a387ba66e8c432

SHA-1: 48f6d8e5c4f55434a3d1fdc1531bd37fb6248d10

SHA-256: d76d9fa7fa75a31b2a62804c8925a1c352f407831865bebc005b7f01676b5ac9

4

Thank you for sharing the details. I have forwarded the same to the team to look into it. I will get back to you with feedback from the team.

5

Hi @Redstraw

Our team checked the details, the verdict was changed and suspicious activity will be marked as malware.

6

@nivedithab Thank you for your quick response and processing. I noticed that this sample is flagged as malware now.

7

Although the online Valkyrie has flagged it as malware, it is still rated as trusted 2hrs later. Is it caused by a delay?

rating
rating895×101 7.47 KB

8

It will be updated soon as malware, i will re verify with team on thr same.

9

@nivedithab I am not sure whether the CIS and XIS share the same online verdict database since it’s still been recognized as trusted here after around 15 hours and the signature data is the latest. I am using the CIS.

11

Hi @Redstraw ,

I am checking with the Verdict team on the issue. I will update you on their feedback on the same.

Thank you