Could somebody check if FP or a real trojan (Moghava)

[cooby]

There's an ongoing discussion about a possible android trojan in one application
http://www.thriveforums.org/forum/toshiba-thrive-general-discussions/12207-alert-avast-antivirus-found-trojan-malware-my-thrive-2.html#post110495

When avast sees malware, does it grab the file or is it up to the user to submit? If so, where.

[Filip Havlicek]

Hi,

click on the detection - report false positive. I'll forward the link to some guys in the virus lab.

Filip

[Flippy]

Hello Cooby,

can you please send us strictly that .apk file please? Or even better just classes.dex for analyze? Even more people report this detection as false positive. But whats strange this detection is almost three months old and no one have any problems until now. And as you can see its works on malware pretty well.

https://www.virustotal.com/file/94bb6ade1ef31c6c96b98c7d8fad1abbc794292730f4363ea3cd9204fc5c9dfd/analysis/

Thank you & best regards

Filip Ch.

[cooby]

@Filip Ch, The link you posted is not about what we're dealing with

Application is imageresizer-1.apk. I installed it yesterday to join that thread, it got flagged.
We all figured that when CommunityIQ is set, you already pulled the file!
I did not yet resolve in Avast, not sure what will happen.

So I still have the application installed as well as a copy of .apk on external card.
It was flagged by Avast as well as one scan on Virus Total. Subsequent VT scan said it's ok.
I see the .dex files. Which do you want to see - the one for the application or VirusTotal applications?

Can I just zip everything I've collected including few screen shots and mail/submit someplace? If so, where?

@Filip Havlicek, how can I report it as FP when I do not know it is FP. Also once resolved, it'll be gone, so for now keeping it unused till you tell me is ok to delete.

[Filip Havlicek]

Well it doesn't matter if you know it is actually a FP or not. What matters is if you think it might be a FP. If that is the case, just report it. The detection won't get automatically removed, it's more like one of our guys will take a close look at it and make a decision.

You can send the ZIP directly to chytry[at]avast[dot]com or to me (havlicek[at]avast[dot]com).

Filip

[cooby]

Mailed. Thanks

[cooby]

It was a FP, and the scan today using June 22 definitions no longer alerts.
Thank you both for quick help