Trojan:Win32/Wacatac.B!ml

[evanerkan]

Windows Defender detects Trojan:Win32/Wacatac.B!ml in syncthing-1.27.2-setup.exe?

[evanerkan]

Although VirusTotal undetected.

[evanerkan]

webfile: C:\Users\idea\Downloads\syncthing-1.27.2-setup.exe|https://objects.githubusercontent.com/github-production-release-asset-2e65be/442602783/92b19dd7-e2c7-4242-920c-00d913fb1c2b?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240103%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240103T025702Z&X-Amz-Expires=300&X-Amz-Signature=928dff2237d69081e39fcaeb926a861460e92b99c10db80acc7c11516d7dc8c7&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=442602783&response-content-disposition=attachment%3B%20filename%3Dsyncthing-1.27.2-setup.exe&response-content-type=application%2Foctet-stream|pid:25616,ProcessStart:133487242342654026

[malcolm77]

I also got this, Defender detected and deleted it. 1.27.1 seems OK though.

[Syr0]

Crowdstrike also flagged the installer https://www.virustotal.com/gui/file/6899dcdace56d06f5a14ff221c38a220b913f7a475a5ba9ed437cb513d28dec4/detection

[Syr0]

Although VirusTotal undetected.

It is detected.

[Bill-Stewart]

This is, of course, a false-positive detection. I have submitted it to Microsoft as such. Crowdstrike has no means for non-customers to submit false-positives, so someone that is a Crowdstrike customer will need to submit the installer as a false-positive.

[aussiesasquatch]

I have tried both 1.27.1 and 1.27.2 and each time it has come up with blocking from bitdefender no matter what I have tried, it says it is malicious encrypted command being run on powershell.

[Bill-Stewart]

The answer is the same: Submit the installer file to the vendor as a false-positive.

[aussiesasquatch]

Bitdefender won't allow files above 25mb in size, the exe file is just over that limit, am unable to submit to bitdefender as the file is required as part of the submission.

[Bill-Stewart]

Sorry, I'm not able to help with that as I don't work for BitDefender and I don't manage their web services. I would suggest whitelisting it or contacting the vendor. (This is a BitDefender issue, not a Syncthing Setup issue.)

[aussiesasquatch]

Already tried whitelisting both versions, didn't work, will contact Bitdefender directly.

[aussiesasquatch]

The false positive sample has been submitted to Bitdefender for analysis, will advise of updates.

[gulbrain]

It's possible the reworking the installer* has introduced this false positive. May I suggest (in a few weeks) updating the third-party tools used to build the installer and releasing a new version to see if the problem is resolved?

• Unless, of course, you spot something tomorrow on their release notes saying this is resolved - in which case, don't hesitate ;-). ** I read the history.md as indication that it is now built using "Go", whereas it may have been built for some time using older versions of "Go"

[Bill-Stewart]

Which third-party tools need updating?

[gulbrain]

"Go" I'm not saying it is the cause - just that updating "Go" (whenever there is an update) might resolve the problem.

[Bill-Stewart]

Go is the programming language used to compile the Syncthing executable, but is not otherwise a part of this project.

[Bill-Stewart]

FWIW: I am working on a command-line tool to replace startps.exe and the PowerShell scripts in the Syncthing Windows Setup installer due to the prevalence of security software paranoia regarding encoded PowerShell command lines. Hopefully this will help reduce the number of false-positives.

[evanerkan]

Thank you for your efforts and sorry for any hassles this all suddenly brought up. This now makes more sense to me. Here's to improvements in development and shared learning for all. Wish you and this fantastic project the best.

[Bill-Stewart]

The new tool is published - https://github.com/Bill-Stewart/asmt The next version of Syncthing Windows Setup will use this tool instead of startps.exe and the PowerShell scripts.

[Bill-Stewart]

As I write this, looks like Windows Defender is not blocking the 1.27.2 installer.

[evanerkan]

thank you