How do i know if a file is Labled by CAMAS as Suspicious,Suspicious++ or Malware?

1

Hello Xcitium
How do i know if a file is rated by CAMAS as CAMAS.Suspicious or Suspicious+ or Suspicious++ or CAMAS.Malware?

2

@nivedithab ? Please help

3

hi @Nik

apologies for the delayed reply,

I will check with the concern team and get back to you.

thank you

1 Like
4

@nivedithab Any news on how do i know when its CAMAS.Suspicious or CAMAS.Malware ?

5

@nivedithab i found on killswitch that it has Camas but every time it says Error(Timeout)
so if Camas works on Verdict Cloud why does it not work on Killswitch?
image
Killswitch version:
image

6

@nivedithab Are you here?
What is happening?

7

hi @Nik

apologies for the delayed response , i have already forwarded the details to the concern team and waiting for their update on the same

1 Like
8

CAMAS works perfectly on Xcitium Verdict Cloud but we dont know if its CAMAS.Suspicious or CAMAS.Malware
so if the team could add classification of CAMAS is it Suspicious or Malware so we know which CAMAS verdict is given to the file

9

@Nik

i have already forwarded the details to the concern team and waiting for their update on the same

1 Like
10

Yes thanks under Dynamic Analysis Overall Verdict tab it should say which CAMAS verdict it is like CAMAS.Suspicious or CAMAS.Malware or CAMAS.Suspicious++ or CAMAS.Suspicious+
for exeample

image
image1562Ă—517 31.9 KB

Here where is the arrow the team can add CAMAS Analysis Verdict there is enough space

11

@nivedithab Under the Dynamic Analysis Overall Verdict the team can add CAMAS Analysis Verdict and the classification CAMAS.Suspicious or CAMAS.Malware,CAMAS.Suspicious+ or CAMAS.Suspicious++

12

hi @Nik

killswitch should be using obsolete Camas service, which one (suppose) is not supported anymore (at least not by our team)

regarding the Valkyrie item : looks like under “Camas” customer means Dynamic Analysis Service (Dynamic Analysis Overall Verdict)
it uses RegExpt and ML analyzer and as possible results: Highly Suspicious (dynamic_malware_probability around 100 ) and “No Threat Found” for the rest (no more options )

Examples:

Dynamic Analysis Overall Verdict Result
Highly Suspicious

Dynamic Analysis Overall Verdict Result
No Threat Found

13

And how do i know if its CAMAS.Suspicious or CAMAS.Malware could the team explain more?

14

hi @Nik

the team has provided examples in the above comment to address your query.

15

Yes but I still dont know if its CAMAS.Suspicious or CAMAS.Malware could the team explain how do i know?

16

@nivedithab Could the team add to Dynamic Analysis Tab CAMAS Analysis Verdict and which it is?
Under the overall verdict it should say is it CAMAS.Suspicious or CAMAS.Malware etc

image
image1570Ă—528 31.8 KB

Right here under the DYNAMIC ANALYSIS OVERALL VERDICT
The team should add CAMAS ANALYSIS VERDICT So we know which CAMAS verdict it is

17

hi @Nik

I will check with the backend team for feasibility and get back to you.

1 Like
18

Hi @Nik

The backend team have shared their feedback on your query.

Camas is obsolete service and the most possible is not supported anymore at all and not integrated with Valkyrie as well

19

In Valkyrie it is supported obviously but its not supported in killswitch because its obsolete

20

@nivedithab Camas in Valkyrie is working and its not obsolete