Hacking DevkitPro updater 2.0.0 Trojan.Win32:Occamy.B

[NicknameGoesHere]

When I install the devkitpro updater version 2.0.0, or i update a previous updater to 2.0.0, windows defender tells me I have Trojan.Win32ccamy.B I've installed this updater version on other windows PC's before without problem. What's going on?

 

[Mazamin]

It should be a false positive, anyway try redownloading it

 

[the_randomizer]

Definitely false positive, add a whitelist to it.

 

[Dimensional]

My devkitpro installer is still 1.6.0, and the official repo has the latest version being 1.7.0, so I'm unsure how you have 2.0.0

 

[NicknameGoesHere]

The link on switchbrew asks me to update the installer, and if I don't, I can't install devkitA64.

--------------------- MERGED ---------------------------

It should be a false positive, anyway try redownloading it

Already tried that

 

[Mazamin]

The link on switchbrew asks me to update the installer, and if I don't, I can't install devkitA64.

--------------------- MERGED ---------------------------


Already tried that

Just temporarily disable your av

 

[NicknameGoesHere]

Ok.

 

[SomeGamer]

Try checking it with VirusTotal.

 

[delete12345]

My devkitpro installer is still 1.6.0, and the official repo has the latest version being 1.7.0, so I'm unsure how you have 2.0.0

Github has the latest version

 

[ballcity]

He's referring to the installer that the libnx instructions point you towards.

http://switchbrew.org/index.php?title=Setting_up_Development_Environment

https://github.com/devkitPro/installer/releases/tag/v2.0.0

https://www.virustotal.com/#/file/3...e67af265047ec4dd0f3cb4b543b37cc9685/detection

So yeah, something is being identified as a Trojan in here. Windows Defender flips out as well. Whether it is clean and a false positive, that I don't know.

 

[NicknameGoesHere]

I can't check it with virustotal right now. Can you check it?

--------------------- MERGED ---------------------------

That was supposed to be sent a while ago.

 

[studio1b]

https://virusscan.jotti.org/en-US/filescanjob/5vd1d0g8vu
https://metadefender.opswat.com/res...KeFc1ZGZGeE9HQkpaLTV1enR4X00/regular/overview
http://nodistribute.com/result/CdjULQGnTFlRz8V0DBEhwmSHM7ck
https://www.virustotal.com/#/file/3...e67af265047ec4dd0f3cb4b543b37cc9685/detection

 

[The Real Jdbye]

https://virusscan.jotti.org/en-US/filescanjob/5vd1d0g8vu
https://metadefender.opswat.com/res...KeFc1ZGZGeE9HQkpaLTV1enR4X00/regular/overview
http://nodistribute.com/result/CdjULQGnTFlRz8V0DBEhwmSHM7ck
https://www.virustotal.com/#/file/3...e67af265047ec4dd0f3cb4b543b37cc9685/detection

No real obvious detections in that, heurestics and generic detections could be false positives. But they could just as easily not.
Since it comes from devkitPro, it's most likely clean, but legit downloads have been hijacked to serve malware in the past, so you never know...

 

[realWinterMute]

When I install the devkitpro updater version 2.0.0, or i update a previous updater to 2.0.0, windows defender tells me I have Trojan.Win32ccamy.B I've installed this updater version on other windows PC's before without problem. What's going on?

My code signing certificate expired and I had to release an unsigned binary for the recent updates. Sadly this apparently means AV programs get over zealous and try to panic people. It's a false positive caused by heuristic analysis.

My devkitpro installer is still 1.6.0, and the official repo has the latest version being 1.7.0, so I'm unsure how you have 2.0.0

1.6.0 should be downloading 2.0.0. The official repo is on github @ https://github.com/devkitPro/installer/releases/tag/v2.0.0

Currently Sourceforge is in meltdown or I'd update what I can to inform people.

I did run a donation drive to raise funds for code cert renewal but, thanks to Myria I've now ordered the needed certificate and crypto card suite. Hopefully that will sort things out when I can sign the binary again.

 

[NicknameGoesHere]

My code signing certificate expired and I had to release an unsigned binary for the recent updates. Sadly this apparently means AV programs get over zealous and try to panic people. It's a false positive caused by heuristic analysis.



1.6.0 should be downloading 2.0.0. The official repo is on github @ https://github.com/devkitPro/installer/releases/tag/v2.0.0

Currently Sourceforge is in meltdown or I'd update what I can to inform people.

I did run a donation drive to raise funds for code cert renewal but, thanks to Myria I've now ordered the needed certificate and crypto card suite. Hopefully that will sort things out when I can sign the binary again.

Ok, thanks for the information!

 

[realWinterMute]

See how it goes with latest installer @ https://github.com/devkitPro/installer/releases/latest

I've changed the compressor slightly and moved a few things around which seems to result in fewer AV suites "detecting" trojans.

 

[realWinterMute]

Finally got Code Signing Cert sorted out again so hopefully 2.1.1 won't trigger AVs now. Let me know if any are still warning.

https://github.com/devkitPro/installer/releases/latest

 

[ballcity]

Finally got Code Signing Cert sorted out again so hopefully 2.1.1 won't trigger AVs now. Let me know if any are still warning.

https://github.com/devkitPro/installer/releases/latest

This is the first version that Windows Defender isn't shutting down right off the bat upon downloading from Chrome. Looks good now!

EDIT - I take that back...

 

[Joom]

Please people, stop using online scanners like VirusTotal. They give nothing but a horribly mediocre glance at heuristics. Crypted malware especially will never be detected by them. Please use something like VxStream, which gives an in-depth analysis of the scanned binary. You'll get everything from network activity and pcaps, to registry and file system modifications. Ideally though, a Cuckoo virtual machine would be better, but I don't see many setting that up.

 

[Joom]

Finally got Code Signing Cert sorted out again so hopefully 2.1.1 won't trigger AVs now. Let me know if any are still warning.

https://github.com/devkitPro/installer/releases/latest

https://www.hybrid-analysis.com/sam...5c92f8e1a5fb068f9bff1cadd55?environmentId=120