Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1077370" data-attributes="member: 86910">Hello there.I did not analyse the file itself, but just based on the reports I do not see any reason to suspect malware in the first place.Firstly VirusTotal shows 1 scanner detecting this as malicious and it is by a scanner that is not exactly known to be accurate. Nothing suspicious to see in the other VT tabs.Secondly the Hybrid-Analysis report: The overall verdict of such automatic analysis systems should be ignored. They are so often wrong. These systems do not know anything about context nor are they really vetted against False Positives. They tend to be way too aggressive and flag behavior as malicious that is completely normal.Let&#039;s take a look at the &quot;malicious&quot; indicators.[ATTACH=full]281859[/ATTACH]This is an installer for Hone. It needs to kill the Hone.exe process to make sure that hone is not running and therefore blocking proper (re-)installation.So this is expected behavior.[ATTACH=full]281860[/ATTACH]All of these are a normal part of installation. Since this is a software that tweaks performance, it will need a driver. So it drops and install a device driver and adds persistence.[ATTACH=full]281861[/ATTACH]It fetches another setup file from a clean host. Maybe to get the latest setup / updates. Also normal for an installer.[ATTACH=full]281862[/ATTACH]This is not so great because it decreases security on the system by enabling powershell scripts in general and I am not sure if the user is made aware of that during installation. While this is not great, this can hardly be called malicious.To sum it up: I do not see a reason for concern.</blockquote>

[QUOTE="struppigel, post: 1077370, member: 86910"] Hello there. I did not analyse the file itself, but just based on the reports I do not see any reason to suspect malware in the first place. Firstly VirusTotal shows 1 scanner detecting this as malicious and it is by a scanner that is not exactly known to be accurate. Nothing suspicious to see in the other VT tabs. Secondly the Hybrid-Analysis report: The overall verdict of such automatic analysis systems should be ignored. They are so often wrong. These systems do not know anything about context nor are they really vetted against False Positives. They tend to be way too aggressive and flag behavior as malicious that is completely normal. Let's take a look at the "malicious" indicators. [ATTACH type="full" alt="1709267902274.png"]281859[/ATTACH] This is an installer for Hone. It needs to kill the Hone.exe process to make sure that hone is not running and therefore blocking proper (re-)installation. So this is expected behavior. [ATTACH type="full" alt="1709268050102.png"]281860[/ATTACH] All of these are a normal part of installation. Since this is a software that tweaks performance, it will need a driver. So it drops and install a device driver and adds persistence. [ATTACH type="full" alt="1709268296126.png"]281861[/ATTACH] It fetches another setup file from a clean host. Maybe to get the latest setup / updates. Also normal for an installer. [ATTACH type="full" alt="1709268412545.png"]281862[/ATTACH] This is not so great because it decreases security on the system by enabling powershell scripts in general and I am not sure if the user is made aware of that during installation. While this is not great, this can hardly be called malicious. To sum it up: I do not see a reason for concern. [/QUOTE]

Verification