Hermetic Wiper detected as PUP ?

[Tech-Nic]

Hello 

Why does Mcafee detect Hermetic Wiper as PUP and not as Virus? 

Event ID : 1027
Event detected : 03/15/22 00:09:51 UTC
Event received : 03/15/22 00:11:39 UTC
Detected By : ENDP_AM_1070 DAT: 4738.0 ENGINE: 6400.9594
Target File Name : C:\Windows\System32\epmntdrv.sys
Threat Name : Herm-Wiper
Threat Type : Potentially Unwanted Program
Threat category : Malware detected
Analyzer Name : McAfee Endpoint Security
Threat Action Taken: Delete
Threat Handled : True
Threat Category : Malware detected
Event Description : Infected file deleted.

Is this specific file (potentially from EaseUS) flagged as PUP just proactive ? 

Thanks
Nicolai

[yaz]

Hi @Tech-Nic 

Thank you for reaching out to Community.

We are currently working on this issue with our labs to see if this could be possible false positive. 

We will provide further updates as soon as it becomes available. 

Was my reply helpful?

If yes, please give me a Kudo.

If I have answered your query, kindly mark this as solution so that we help other community members. 

[Tech-Nic]

Hello Yaz

Thanks for your answer. 
Do you have an estimation how long it will take. From the current situation i do see a urgency for companys potentially attacked by HermeticWiper or not. 

Thanks

Nicolai 

[yaz]

Hi @Tech-Nic 

We should be having an update before End of today. 

I will keep you updated. 

Was my reply helpful?

If yes, Give me a Kudo.

If I have answered your query, kindly mark this as solution. 

[gammer]

Any updates?

One of our servers picked up the exact same file as a Herm-Wiper PUP.

[yaz · Accepted solution]

Hi all, 

Detection Suppressed and it should be available from DAT / AMCORE available today.

Once updated, kindly let us know how this goes. 

Was my reply helpful?

If yes, please give me a Kudo.

If I have answered your query, please mark this as solution so that we help other community members.