Trojan:Script/Wacatac.B!mI

[ffdown]

2.0.4 win32 Обнаружено: Trojan:Script/Wacatac.B!mI Состояние: Активно Активные угрозы не устранены. Они сейчас действуют на устройстве, дата: 19.07.2024 8:00 Сведения: Затронутые элементы: Критическая Эта опасная программа выполняет команды злоумышленника. file: C:\Users\user\temp\MicrosoftEdgeDownloads\a9fe8ad5-4a98-4912-b806-9279914fa230\Pinokio-2.0.4-win32.zip

[erdemaydogdu]

Can't even download because of "virus detected" message on chrome and edge.

[palmdoc]

Same here.

[lar-vgo]

Here too

[E2GO]

Same

[ffdown]

Author comment this... ?

[jtabox]

Same here. Clicked the Download for Windows link from here: https://program.pinokio.computer/#/?id=windows. The download was insta-blocked, this is what Windows Defender says it blocked:

webfile: D:\Docs\Downloads\Pinokio-2.0.4-win32.zip|https://objects.githubusercontent.com/github-production-release-asset-2e65be/664226598/ae91109a-e62b-4d2c-9408-9c00aeb74640?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240719%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240719T193222Z&X-Amz-Expires=300&X-Amz-Signature=74cf3b8d9208c6ae831e45af361999b6a9af63f1f96fcadb542fd87703fddb1d&X-Amz-SignedHeaders=host&actor_id=56894914&key_id=0&repo_id=664226598&response-content-disposition=attachment%3B%20filename%3DPinokio-2.0.4-win32.zip&response-content-type=application%2Foctet-stream|pid:25400,ProcessStart:133658911027081438

Which is weird, because hovering the mouse over the download link (or right-click-copying link) shows https://github.com/pinokiocomputer/pinokio/releases/download/2.0.4/Pinokio-2.0.4-win32.zip.

Edit: apparently it doesn't seem possible to download via curl in Windows either, the output file is 0 bytes. Not really sure what the issue is, will try getting it inside a sandbox.

Edit 2: It downloaded fine inside a Windows Sandbox, so if anyone has Windows 11 and sandbox enabled, you can try it. I extracted the installation exe, and fwiw VirusTotal says it's squeaky clean. https://www.virustotal.com/gui/file/557067a7f30ea38f3f3715aab00f2260ceb9123f0537976b18eb474c2adeefd6/detection/f-557067a7f30ea38f3f3715aab00f2260ceb9123f0537976b18eb474c2adeefd6-1721401844

[6Morpheus6]

Can't even download because of "virus detected" message on chrome and edge.

That's a false positive from Windows Defender. It doesn't affect all systems, but way too many. Here's an X Post about this issue. https://x.com/cocktailpeanut/status/1814322766784417840

[lar-vgo]

Sandbox solved, thanks

[jtabox]

Out of curiosity, can someone explain what the deal is with the link that gets blocked?

Clicking on the download link, it redirects to this URI:

webfile: D:\Docs\Downloads\Pinokio-2.0.4-win32.zip|https://objects.githubusercontent.com/github-production-release-asset-... a bunch of parameters ...-content-disposition=attachment%3B%20filename%3DPinokio-2.0.4-win32.zip&response-content-type=application%2Foctet-stream|pid:25400,ProcessStart:133658911027081438

I can see some pipes in the link itself, do they work as usual in Linux? The parts between the pipes are those:

webfile: D:\Docs\Downloads\Pinokio-2.0.4-win32.zip

https://objects.githubusercontent.com/github-production-release-asset-... a bunch of parameters ...-content-disposition=attachment%3B%20filename%3DPinokio-2.0.4-win32.zip&response-content-type=application%2Foctet-stream

pid:25400,ProcessStart:133658911027081438

So what does this do? Seemingly takes a locally saved file, pipes it to some address that spits it out as byte stream and pipes it to some process it tries to create? Is this a common thing? Why not let me choose if I want to open the zip myself? So many questions...