search

Arkhist / Hacknet-Pathfinder

Hacknet Labyrinths Modloader in C#
MIT License
109 stars 18 forks source link

v5.3.2 triggers Windows Defender #228

Open fstk5 opened 10 months ago

fstk5 commented 10 months ago

Only happens with the latest version, none of the others have an issue.

image image

dandykong commented 8 months ago

It also triggers at thirteen other AVs, with some concerning Mitre flags. Manual dump creation, tampering with Windows Error Reporting, setting a file association for .exe, VM busting, data exfiltration, and more. The source code looks clean though.

https://www.virustotal.com/gui/file/734a6a48383aa792fb03fdc98cba685b0455ec8a4aab0d3d4cc469968d666734

Arkhist commented 8 months ago

https://stackoverflow.com/questions/43777106/program-made-with-pyinstaller-now-seen-as-a-trojan-horse-by-avg

Seems like the issue is from Pyinstaller looking suspicious, nothing more.

The building process is handled in Github through build actions, same thing for the packaging of the release. Nothing released here touches our computer. pyinstaller --onefile --noconsole PathfinderInstaller.py is the command used for building, the packages "requests" and "pyinstaller" are required.

Leila-Codes commented 1 month ago

Not sure if it got fixed in later versions, but as of right now, Windows Defender isn't detecting anything on the 5.3.4 installer!