[OnePlus 8T Guides, News, & Discussion] evilhawk00:
That depends on how the security software detects it.

First, take a look at the malware names:

If you see a specific name from a malware family, that usually means the sample matches the signature or pattern of a known malware that was inspected by a security researcher employee. In this kind of case, the answer is usually YES.

If you see a name that looks "unspecific", that usually means the safety of the file is unverified. The security software sends the copy to their cloud server and uses machine learning (or Heuristic analysis) to evaluate the risk of the file. After the evaluation, they calculate the malicious score and check if that score reaches a predefined value. If the malicious score is high enough, the antivirus gives it a generic or unspecific name randomly. In this case, the answer is often NO, because the AI is still not accurate enough and often produces false positives.

How does the AI work with Antivirus?

Some vendors use Heuristic Analysis, some use Machine Learning. What's the difference between the two?

Let's be simple here, assume that I'm going to create malware, and my malware needs to do something stealthy, so I force a neutral legit process to do my dirty job for me. In order to achieve this, I use CreateRemoteThread(). Now, the Heuristic Analysis checks my API calls and found this, it gave me 20 points of malicious score. Also, I need to hide some sensitive hardcoded data in the binary, such as botnet C&C server IP....etc, so I may use Microsoft Cryptographic Services or a 3rd-party OpenSSL library. The Heuristic Analysis also found this, it gave me another 20 points of malicious score. If the maximum risk score is 30 points, then it flagged my software as malware, if the maximum risk score is 60 points, then my software is clean. The above is about Heuristic Analysis. And about what Machine Learning is used with AntiVirus, there's a good article written by KasperskyLabs.

Problem?

The biggest problem is false positives. Maybe my software calls Microsoft Cryptographic Services, but it is used to decrypt a DRM package from the server? A lot of maybes......especially when Heuristic analysis rules are strict. If you Google user feedback of some AI-based Antivirus, such as Cyglance, SentinelOne, BitDefenderTheta......you may see a lot of false positives complaining in online forums.

Okay, now back to the topic, take a look at the detection name from VirusTotal. I see all the detections are detected by Machine Learning, these results still need confirmation. The most interesting part is that BitdefenderTheta thinks it is malicious but Bitdefender says it is clean. This makes sense, Bitdefender tries not to produce many false positives so they didn't put the ML result directly into their widely sold Home&Business Bitdefender products. They may have filtered some of the ML results in their Home&Business Bitdefender products because they know these results still require some confirmation from their employees.

Furthermore, you can see Sophos AI even think it is a PUA(Potential Unwanted Application) but not a virus.

btw, for research purposes, I tried to understand what kind of codes can trigger ML antivirus. So I've built some simple binaries with API calls that are commonly used in malware and uploaded them to virustotal. The most interesting part is that every few months I rescan the file, again and again, and the results are always different. Seems like these AIs are changing their rules or risk model every month, they can't really tell if the file is harmful or harmless accurately, they can only tell if the file is suspicious. However, one looks suspicious doesn't always mean one is a criminal, the biggest drawback of ML.