Rufus 3.8 | Infected with malware?

[RoboMan]

As a daily rutine on context-scanning or analyzing with VT every executable I download, this got my attention. I was trying to create a bootable USB with Rufus.

VirusTotal threw this: GrayWare/Win32.Generic

Yeah, I know what you are thinking. 1/60 is definitely a false positive.

Well, on the third analysis section (relations) on Rufus 3.8, content of the executable was sandboxed and tested, where it ended with the parent executable Win32 EXE d9da5ddf53b891f94b0a78ed043645ea.virus.

After opening the parent executable contained in Rufus 3.8, it's found a compilation of all these beauties.

Opinions?

 

[harlan4096]

I have rufus 3.8 in my system, in fact just used it to save new W10 1909 in a pendrive:

​

This is Clearly a false positive... but if You have a rufus 3.8 with many other AV detections, then it is probably an infected copy of the tool...

 

[ForgottenSeer 76546]

It's most likely a false positive. See

 

[RoboMan]

Although I understand 1/68 can be and will probably be a false positive, how can a parent process of the rufus executable trigger 60/68?

 

[BoraMurdar]

Although I understand 1/68 can be and will probably be a false positive, how can a parent process of the rufus executable trigger 60/68?

Kaspersky, Microsoft, ESET, Symantec doesn't sound at this detections... It's most probably a false positive. Most detections came from Bitdefender definitions...

 

[RoboMan]

Kaspersky, Microsoft, ESET, Symantec doesn't sound at this detections... It's most probably a false positive. Most detections came from Bitdefender definitions...

In the last picture, Kaspersky, Microsoft and ESET detect the parent executable as malware

 

[BoraMurdar]

In the last picture, Kaspersky, Microsoft and ESET detect the parent executable as malware

I cannot see that, sorry...
Just yesterday I created a bootable ISO of Windows 10 1909 and Kaspersky didn't alert me about anything suspicious

 

[harlan4096]

The same here today...

 

[BoraMurdar]

@Robbie
Where did you download Rufus tool?

 

[RoboMan]

@Robbie
Where did you download Rufus tool?

Official website.

VirusTotal

VirusTotal

www.virustotal.com

 

[harlan4096]

Just downloaded again rufus 3.8 from Rufus - Cree unidades USB arrancables fácilmente and:

 

[RoboMan]

Just downloaded again rufus 3.8 from Rufus - Cree unidades USB arrancables fácilmente and:

View attachment 228010​

I may be misunderstanding then. VirusTotal throws execution parents as dangerous processes; but I do not yet understand if it's actually the parent processes that spawn it, or it just compares world-wide the parent processes that ever spawned rufus process.

 

[EndangeredPootis]

I may be misunderstanding then. VirusTotal throws execution parents as dangerous processes; but I do not yet understand if it's actually the parent processes that spawn it, or it just compares world-wide the parent processes that ever spawned rufus process.

Virustotal always show a ton of engines detecting the parent exe on all programs, its a glitch on their end.

 

[Lemon60]

Alright, i run Rufus 3.8 on app.any.run, and Rufus disable Windows Defender. rufus-3.8.exe (MD5: A0B4E4566AA96B6658B32075492B43B7) - Interactive analysis - ANY.RUN
I send Rufus 3.8 to MS and;

I don't understand what is this.

 

[RoboMan]

Alright, i run Rufus 3.8 on app.any.run, and Rufus disable Windows Defender. rufus-3.8.exe (MD5: A0B4E4566AA96B6658B32075492B43B7) - Interactive analysis - ANY.RUN
I send Rufus 3.8 to MS and; View attachment 228011

I don't understand what is this.

 

[BoraMurdar]

What's the SHA-256 for your Rufus downloaded today?

 

[RoboMan]

What's the SHA-256 for your Rufus downloaded today?

cb641345d6c01e6b16ab18ad930eb7218f270eb319a4b7fb599ce88b5ae18159

 

[harlan4096]

Same here (check my previous screen-shots)

 

[BoraMurdar]

cb641345d6c01e6b16ab18ad930eb7218f270eb319a4b7fb599ce88b5ae18159

Damn, I never have a VM at the hand when this stuff happens!
Either this thingy is impossible or you just found a zeroday (if all of this is true)

You can see the new experimental features of Rufus but I cannot see the connection between those and disabling WD

 

[Andrew3000]

https://www.joesandbox.com/analysis/184269/0/html