False positive SentinelOne alert for 3CX Desktop App

[Philip_Frias | Apex 365]

Sentinel One Detections : \Device\HarddiskVolume3\$Recycle.Bin\S-1-12-1-1338685341-1315038988-2350169759-4170795823\$RE78NZB.msi
\Device\HarddiskVolume3\$Recycle.Bin\S-1-12-1-1338685341-1315038988-2350169759-4170795823\$R2B7DYB.msi

Both malwares are being detected from 3CX LTD. Are these false positives? We have tagged it as true positive though, this is being detected on one of our user's devices and we assume that this is the 3CX Desktop App. Just want to confirm , is 3CX Desktop App now safe for use? Or we still advise our customers to use the Web App.

Looking forward to hear from the team , thank you.

Best Regards,

Philip Frias, Jr.
Technical Services and Support

 

[TheodorosG_3CX]

Hello @Philip_Frias | Apex 365 thank you for the report.
I will contact you shortly for via pm for more information.

 

[TheodorosG_3CX]

A ticket with the number: 1132302 , has been opened with the Anti-Virus vendor for feedback. Once this has been received further updates will be posted here.

Our communication will remain transparent throughout this investigation.

 

[Charles_3CX]

Hi Philip_Frias | Apex 365

Can you please clarify the exact version of the desktop app that you are referring to?

You have mentioned 18.12.416. Is this the version that you have installed?

If so, this desktop app version was compromised per multiple mailers and blog posts sent out over the past month regarding this matter. https://www.3cx.com/blog/news/desktopapp-security-alert-updates/

We strongly advise you to uninstall this desktop app version and recommend using the PWA.

If you must use the desktop app, then you can use the latest cleared version https://www.3cx.com/blog/releases/v18u7-desktop-app-electron/

 

[TheodorosG_3CX]

Marking this as False Positive.

As per the information provided by customer, he was using an outdated version of our software. He stated he is on Desktop App version 18.12.416 and ourlatest version is 18.12.425.

It's essential that all 3CX users upgrade their PBXs with each 3CX update as per blog announcements: https://www.3cx.com/blog/releases/v18u7-desktop-app-electron/

We have not received any response from SentinelOne.

 

[Philip_Frias | Apex 365]

Hi Philip_Frias | Apex 365

Can you please clarify the exact version of the desktop app that you are referring to?

You have mentioned 18.12.416. Is this the version that you have installed?

If so, this desktop app version was compromised per multiple mailers and blog posts sent out over the past month regarding this matter. https://www.3cx.com/blog/news/desktopapp-security-alert-updates/

We strongly advise you to uninstall this desktop app version and recommend using the PWA.

If you must use the desktop app, then you can use the latest cleared version https://www.3cx.com/blog/releases/v18u7-desktop-app-electron/

Hello , yes that is the exact version. No problem , I'll inform our customer then. Thanks for the update!