Malicious or just a sketchy program?

Xeno1234

Xeno1234

Level 14
Thread author
Jun 12, 2023
663
1
1,182
1,266
I was having some PC issues, wanted to check if the PSU was being maxed out so I came across this: VirusTotal. I also have the actual download link:

Download LocalCooling 2.0 - free - latest version

Download LocalCooling 2.0 for Windows now from Softonic: 100% safe and virus free. More than 1031 downloads this month. Download LocalCooling latest v
en.softonic.com en.softonic.com
Its supposed to measure your power consumption, yet its very inaccurate, and according to the V T comments is malware.
Could someone check this out for me? I dont want to risk downloading it and uploading it to Tria.ge, so I only have VT and actual download link
 
  • Like
Reactions: Dave Russo
I understand your concern about downloading potentially malicious software. I will analyze the information you provided and give you my assessment.

Firstly, let's discuss the VirusTotal report you shared. The file you linked to on VirusTotal has a detection ratio of 7/69, which means that 7 out of 69 antivirus engines flagged it as potentially malicious. While this is not a conclusive indication of malware, it does raise some suspicion.

Regarding the download link you provided from Softonic, it's important to note that Softonic has a history of bundling legitimate software with potentially unwanted programs (PUPs) or adware. So, it's always advisable to exercise caution when downloading from such sources.

Given the information available, it is difficult to determine with certainty whether the program you mentioned is malicious or just sketchy. However, I can offer you some general advice to help you stay safe:

1. Stick to trusted sources: Whenever possible, download software from official websites or reputable sources. This reduces the risk of downloading malware or unwanted programs.

2. Check user reviews: Before downloading a program, read user reviews and comments to get an idea of other people's experiences. If there are numerous reports of malware or suspicious behavior, it's best to avoid the software.

3. Use a reliable antivirus program: Having a reputable antivirus program installed on your computer can help detect and prevent the installation of malware.

4. Consider alternative software: If you're looking for a power consumption measuring tool, consider using a well-known and widely used program recommended by reputable sources.

In conclusion, based on the information you provided, it's difficult to determine the nature of the program you mentioned. However, it's always best to err on the side of caution and avoid downloading software with a questionable reputation.
 
Xeno1234 said:
I was having some PC issues, wanted to check if the PSU was being maxed out so I came across this: VirusTotal. I also have the actual download link:

Download LocalCooling 2.0 - free - latest version

Download LocalCooling 2.0 for Windows now from Softonic: 100% safe and virus free. More than 1031 downloads this month. Download LocalCooling latest v
en.softonic.com en.softonic.com
Its supposed to measure your power consumption, yet its very inaccurate, and according to the V T comments is malware.
Could someone check this out for me? I dont want to risk downloading it and uploading it to Tria.ge, so I only have VT and actual download link
Click to expand...
I've got some extra links:

163b72f08fd988f4bc5688c8b95ceff4fd827d536dcccc72ea7421abaa1b8b34 | Triage

Check this report malware sample 163b72f08fd988f4bc5688c8b95ceff4fd827d536dcccc72ea7421abaa1b8b34, with a score of 7 out of 10.
tria.ge tria.ge
 
  • Like
Reactions: Dave Russo
Never heard of that program, perhaps others have and can confirm its legitimacy. An awesome program which I recommend and has been widely used and tested, would be AIDA64. It'll show you full PSU stats and then some! I'd recommend the trial version of AIDA64 Extreme.
 
  • Like
Reactions: Dave Russo, simmerskool and oldschool
LocalCooling2.msi
59c6e708a2694c3e83d72ab195c38e2dfcb55e4662de9015e8397592692fd948
Kaspersky Threat Intelligence Portal reports its hash as "clean" but VT community gives it some negative ratings including sending a password unencrypted.. ??
 
  • Like
Reactions: Dave Russo
simmerskool said:
LocalCooling2.msi
59c6e708a2694c3e83d72ab195c38e2dfcb55e4662de9015e8397592692fd948
Kaspersky Threat Intelligence Portal reports its hash as "clean" but VT community gives it some negative ratings including sending a password unencrypted.. ??
Click to expand...
Yeah. What I was concerned about.
Sophos also says good reputation.

Someone I asked in a malware removal forum (because I did run this, but have tried to remove it) said this was 100% clean.
 
  • Like
Reactions: Dave Russo and Nevi
It's not malicious. It was first uploaded to VirusTotal in 2008. If it was malicious, signatures would have been added to detect it years ago. It was published by Uniblue. Most of their software could be classified as PUPs, but they never released anything malicious. While I recommend downloading from the publisher's website, in this case it's only available from third party download sites, as Uniblue went out of business in 2018.
 
  • Like
  • Hundred Points
Reactions: struppigel, brambedkar59, Dave Russo and 3 others
roger_m said:
It's not malicious. It was first uploaded to VirusTotal in 2008. If it was malicious, signatures would have been added to detect it years ago. It was published by Uniblue. Most of their software could be classified as PUPs, but they never released anything malicious. While I recommend downloading from the publisher's website, in this case it's only available from third party download sites, as Uniblue went out of business in 2018.
Click to expand...
Uniblue, according to Kaspersky, has HEUR:Hoax detections. They refer to those as things like scareware or things related to PUA type stuff.
I do find it weird that someone did say that bitdefender said it tried sending passwords to their servers? For me, it closed chrome whenever it ran which is something (some) stealers do.
 
  • Like
Reactions: Dave Russo, Nevi, roger_m and 2 others
I've sent to K. analysts these samples:

59c6e708a2694c3e83d72ab195c38e2dfcb55e4662de9015e8397592692fd948
340c9405d4cf5df723e3226f51d47a26ae544e1ba1aafde8f6c58179c5735d81
Click to expand...

In both cases attaching VT (0 detections) link where those negative comments are, pointing maybe a possible password stealer, and in both cases I got a:

Hello,

No malicious software was found in the attached file.

Best regards, Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 Kaspersky Cyber Security Solutions for Home and Business | Kaspersky Securelist | Kaspersky’s threat research and reports
Kaspersky Threat Intelligence Portal - get insights about suspicious files, hashes, URLs, IP addresses or domain names
Click to expand...
 
Last edited:
  • Like
  • +Reputation
Reactions: upnorth, Guilhermesene, simmerskool and 6 others
I am not seeing anything suspicious about the file. These comments from anonymous posters are the only thing that is phishy, but not one of them is from a person I know or trust (the malware analysis community is very small).

The one person with high voting power has been consistently spamming "Malware" comments on VT with 0 detection rates and no explanation as how their verdict was made. This account is proof that the reputation system on VT does not work well to distinguish between experts an non-experts.

It is more likely that the downvoters were enticed to do that after some misinformation that is publicly available or they did that because they were dissatisfied with the program itself. However, a program that is buggy or does not work well for its purpose it is not a reason for a malware verdict.
 
  • +Reputation
  • Hundred Points
Reactions: upnorth, simmerskool, roger_m and 2 others
You must log in or register to reply here.

You may also like...