Avast WEBforum

Other => Viruses and worms => Topic started by: Парфенов on July 15, 2020, 03:46:03 PM

Title: Script Snh-gen trj
Post by: Парфенов on July 15, 2020, 03:46:03 PM

Hello!
When I open Microsoft office file from desktop, Avast shows alert like in attachment.
When I open same file from any other place nothing happens.
Maintained full check - no viruses.
It started yesterday.

Title: Re: Script Snh-gen trj
Post by: polonus on July 17, 2020, 12:08:29 AM

Hello Парфенов,

Consider this malcode detection also in the light of this warning:
Trojan/Win32.Wacatac (MS) a.k.a. Script Snh-gen trj (avast) is being abused in spyware attacks by APT groups,
read CISA's TLP White Report: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a on SOREFANG attacks  :D
against SSL VPN servers. (Report was issued yesterday - 16-7-2020)

polonus (volunteer 3rd party cold recon website security-analyst and website error-hunter)