Email attachment dropped malware in system

[Sudip1]

Hi,

I have a hash value for a file which was attached with an Email. It is suspected as malware and also detected by a number of antiviruses as per virus total ,but McAfee has not detected  it as malware.

I don't have the sample file with me so i'm not able to upload it to the McAfee portal. Is it possible for McAfee to download the file from virus total from the hash value? If so can you please confirm why McAfee is not detecting the file as malicious?

Hash : 1c6ef06f48256543d9fc81199af54025a42a20bf01a2eedd49b85d2c1f580541 

[Former Member · Accepted solution]

Hi @Sudip1 

I can confirm that we do have GTI detection for this file. But it is not covered by DAT at this time. If you raise an SR with us, we would be able to provide you with an ExtraDAT if you wish for protection by content.

[Sudip1]

Hi Chealey,

Thanks for your reply.

So when we can expect the signature in daily DAT itself?

Till then should we update all the systems with extra DAT, that may be victim for this malware ?

[Former Member]

I'm afraid we can't share an ETA on when it will be added. It has to go through various validation channels before being added. If your systems have GTI look ups enabled, then they are already protected. As I said if your systems aren't able to reach our GTI servers and you require an ExtraDAT then yes, please raise a Service Request so we can generate one and share with you for protection.