Malware Analysis PC Optimization Malware?

[Silverwing]

Found this PC optimizer called “hone.gg”. It appears to be legitimate, their discord has 20000 members, signed by overwolf, and has sponsorships with YouTubers.

I downloaded this from home.gg (I don’t have direct links, search up hone.gg, you’ll find it) to try and see if it helps. However:

Kaspersky flagged it as malware and so did hybrid analysis. More specifically, it flagged a file it dropped called “installer”.

Could you all take a look for me?

https://www.hybrid-analysis.com/sample/170d1e2076c232de4023fef265fcb49b838035209cb01fcdbd347033bed9ca04/65e0fb381e21a181570d8c90

Found this interesting too:


Kaspersky has a signature detection? Bitdefender flags too?

 

[struppigel]

Hello there.

I did not analyse the file itself, but just based on the reports I do not see any reason to suspect malware in the first place.

Firstly VirusTotal shows 1 scanner detecting this as malicious and it is by a scanner that is not exactly known to be accurate. Nothing suspicious to see in the other VT tabs.

Secondly the Hybrid-Analysis report: The overall verdict of such automatic analysis systems should be ignored. They are so often wrong. These systems do not know anything about context nor are they really vetted against False Positives. They tend to be way too aggressive and flag behavior as malicious that is completely normal.

Let's take a look at the "malicious" indicators.

This is an installer for Hone. It needs to kill the Hone.exe process to make sure that hone is not running and therefore blocking proper (re-)installation.
So this is expected behavior.

All of these are a normal part of installation. Since this is a software that tweaks performance, it will need a driver. So it drops and install a device driver and adds persistence.

It fetches another setup file from a clean host. Maybe to get the latest setup / updates. Also normal for an installer.

This is not so great because it decreases security on the system by enabling powershell scripts in general and I am not sure if the user is made aware of that during installation. While this is not great, this can hardly be called malicious.

To sum it up: I do not see a reason for concern.

 

[Silverwing]

Hello there.

I did not analyse the file itself, but just based on the reports I do not see any reason to suspect malware in the first place.

Firstly VirusTotal shows 1 scanner detecting this as malicious and it is by a scanner that is not exactly known to be accurate. Nothing suspicious to see in the other VT tabs.

Secondly the Hybrid-Analysis report: The overall verdict of such automatic analysis systems should be ignored. They are so often wrong. These systems do not know anything about context nor are they really vetted against False Positives. They tend to be way too aggressive and flag behavior as malicious that is completely normal.

Let's take a look at the "malicious" indicators.

View attachment 281859
This is an installer for Hone. It needs to kill the Hone.exe process to make sure that hone is not running and therefore blocking proper (re-)installation.
So this is expected behavior.

View attachment 281860

All of these are a normal part of installation. Since this is a software that tweaks performance, it will need a driver. So it drops and install a device driver and adds persistence.

View attachment 281861
It fetches another setup file from a clean host. Maybe to get the latest setup / updates. Also normal for an installer.

View attachment 281862

This is not so great because it decreases security on the system by enabling powershell scripts in general and I am not sure if the user is made aware of that during installation. While this is not great, this can hardly be called malicious.

To sum it up: I do not see a reason for concern.

That makes sense. I’m pretty sure hone changes windows policies, graphics card settings, etc to boost performance as much as possible. I probably won’t use it but thanks for checking it out.