HazelnutCheese
commented
1 year ago Hi I'm investigating this now. I built everything on my machine so if this is true then maybe my machine is infected or maybe one of the nuget packages I'm using is.
If I can confirm this issue for myself I will try to get rid of the affected files.
It looks like those links you have provided require an enterprise account on VirusTotal. I tried scanning the MSI myself and I can't see any graph or anything. Could you provide a screenshot of those pages or copy the information into a comment?
Art3mis-Ghub
Hi,
As a standard safety procedure when downloading files, I scanned your .msi using VirusTotal.
The website showed it as 0/67 vendors or sandboxes having detected it as malicious, great, right? Looking into it further, there were actually three vendors that flagged it as malicious due to a win32 EXE packaged inside the executable. Going deeped and checking the graph, I noticed that it was a peexe file that was flagged three times as containing the following malicious files;
Now, these can of course be false-positives if the file itself behaves in a way similar to the Trojan Malware, so nothing to be overtly concerned about, yet. Again, looking further into this I noticed that the Contacted IPs node is flagged, so naturally I checked it out, out of the five detected IPs only one was flagged, 13[.]107[.]4[.]52, now here's where it starts to get concerning. Last year numerous reports arose around the internet, flagging this exact IP as one used by Pro-Russian Hacktivists or ''TAs'' (Threat Actors) to ''jump'' malware across the net onto unsuspecting executables, and I'm afraid yours might be one of them.
This group, ''Killnet'' uses a modified version of the notorious ransomware called ''Chaos Ransomware'' and upon execution, this version of Chaos Ransomware will lock the owners PC and drop a note that contains links to a Telegram group filled with Pro-Russian propaganda as well a BTC address and contact information for the TAs.
Please, remove this file and quarantine it immediately to ensure that you, and others, do not get forced into financially supporting the Russian War effort.