Homebrew Discussion PSA: SuperLan might be a virus

[focusonme]

so i shouldn't use superlanplay?

 

[maxx488]

so i shouldn't use superlanplay?

Yes you should

 

[LUCKASS]

so i shouldn't use superlanplay?

To be sure, just use the regular SwitchLanPlay, it does the exact same thing.

 

[linuxares]

So, what is this?
https://github.com/D3fau4/Super-Lan-Play/raw/master/Super-lan-play-client-b.exe

Also, why is WinPCAP downloaded?

Switch Lan Play require Winpcap to capture the signals from the Switch.

 

[LUCKASS]

10(dd)/12(mm)/2018 @ 10:50AM
Analyse for the "client-b" (SHA256: 41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3)
Analyse for the "client" (SHA256: c304b194c4be0a6808e18a159b32faaec0ffd970fce117104633feb8a1ec18cd)

It's a quite bad ratio in my opinion for the "client-b"

Someone has an explanation concerning the difference between the two client, I'm not using superlan for now.
And is there more player connected to superlan ? I checked the original lan soft and there is only 32 players connected to US server.

 

[linuxares]

10(dd)/12(mm)/2018 @ 10:50AM
Analyse for the "client-b" (SHA256: 41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3)
Analyse for the "client" (SHA256: c304b194c4be0a6808e18a159b32faaec0ffd970fce117104633feb8a1ec18cd)

It's a quite bad ratio in my opinion for the "client-b"
Someone has an explanation concerning the difference between the two client, I'm not using superlan for now.

Wow Client-B got WAAAAY to many hits for being a false positive. I mean Bitdefender? Variant.MSILPerseus.172810 is a real trojan and not a false positive statement, so that file is fishy as all heck now.

 

[Localhorst86]

10(dd)/12(mm)/2018 @ 10:50AM
Analyse for the "client-b" (SHA256: 41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3)
Analyse for the "client" (SHA256: c304b194c4be0a6808e18a159b32faaec0ffd970fce117104633feb8a1ec18cd)

It's a quite bad ratio in my opinion for the "client-b"
Someone has an explanation concerning the difference between the two client, I'm not using superlan for now.

presumably - and that's just a wild guess - the "client-b" seems to be compressed, whereas "client" isn't.
And since this is a method viruses use to obfuscate themselves from being identified by a checksum, client-b is caught in the heuristic engines of various Antivirus Software because it simply utilizes similar methods to real viruses.

While I would more assume it's a false positive, i'd still stay clear off the tool and I recommend everyone to do the same.

 

[focusonme]

To be sure, just use the regular SwitchLanPlay, it does the exact same thing.

presumably - and that's just a wild guess - the "client-b" seems to be compressed, whereas "client" isn't.
And since this is a method viruses use to obfuscate themselves from being identified by a checksum, client-b is caught in the heuristic engines of various Antivirus Software because it simply utilizes similar methods to real viruses.

While I would more assume it's a false positive, i'd still stay clear off the tool and I recommend everyone to do the same.

thank you! will stay the hell out

 

[lordelan]

To be sure, just use the regular SwitchLanPlay, it does the exact same thing.

You might wanna add that to the first post mate.

 

[Joom]

10(dd)/12(mm)/2018 @ 10:50AM
Analyse for the "client-b" (SHA256: 41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3)
Analyse for the "client" (SHA256: c304b194c4be0a6808e18a159b32faaec0ffd970fce117104633feb8a1ec18cd)

It's a quite bad ratio in my opinion for the "client-b"

Someone has an explanation concerning the difference between the two client, I'm not using superlan for now.
And is there more player connected to superlan ? I checked the original lan soft and there is only 32 players connected to US server.

https://avcaesar.malware.lu/sample/41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3

 

[GerbilSoft]

"Client B" is the "beta version". The non-beta version was updated, whereas the "beta" version is still the obfuscated mess it was before.

 

[Localhorst86]

https://avcaesar.malware.lu/sample/41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3

Have you looked at the dates of the virus definitions used?

 

[Joom]

Have you looked at the dates of the virus definitions used?

No, but that wasn't the point of linking that. AV scans are useless to me anyway. They're never to be solely relied on, and really don't offer anything to actual analysis. This is why I despise sites like VT, because they only serve to propagate samples amongst AV companies and give people false hope. Sites like Malwr, AVCeasar, and Hybrid Analysis give detailed reports on the sample. If you wanna do it at home, look into the Cuckoo sandbox, or create your own environment with Komodo, Sandboxie, PE Explorer, and MBAM.

 

[Localhorst86]

No, but that wasn't the point of linking that. AV scans are useless to me anyway. They're never to be solely relied on, and really don't offer anything to actual analysis. This is why I despise sites like VT, because they only serve to propagate samples amongst AV companies and give people false hope. Sites like Malwr, AVCeasar, and Hybrid Analysis give detailed reports on the sample. If you wanna do it at home, look into the Cuckoo sandbox, or create your own environment with Komodo, Sandboxie, PE Explorer, and MBAM.

So, care to comment on what information we should get from your link which we didn't have before?

 

[Joom]

So, care to comment on what information we should get from your link which we didn't have before?

Yeah. It's benign. You guys can stop posting VT links going "omg virus".

 

[Localhorst86]

Yeah. It's benign. You guys can stop posting VT links going "omg virus".

So, just to make sure I am getting this right.

You don't trust sites like virustotal and to "debunk" the results on that site you post a link to another site using highly outdated malware definitions under the premise it gives us "detailed reports" (to quote you) on the file without elaborating what additional detailed information your link is supossed to give us that was not already available on the virustotal results?

I do agree that you should not rely solely on a VT results page, but not everyone in here is a malware forensics expert. And I find it highly dangerous to simply scrub of a result page like this as not potentially dangerous for the sake of less experienced users. But a result like this should always raise a red flag for the average user and if someone asks if they should use this software, our answer should always be "no". Because otherwise next time, they might not ask someone and really run malicious software.

@GerbilSoft has provided a lot of details on this file in this thread already

For the record: I find it reasonable to assume that the software is not actually malware. But this software still has lots of signs that should tell us: better use something else instead.

 

[guyman70718]

edit : 10/12/2018 @ 10:50AM (dd/mm/yyyy)
Analyse for the "client-b" (SHA256: 41251978b0f7f49a895725b39a75639fd4e5a55386d64fb9c54ffd965e793da3)
Analyse for the "client" (SHA256: c304b194c4be0a6808e18a159b32faaec0ffd970fce117104633feb8a1ec18cd)
It's a quite bad ratio in my opinion for the "client-b" (too many hits to be a false positive)


To be sure, just use the regular SwitchLanPlay, it does the exact same thing.

It's maybe a false-positive, it's maybe a virus
I just wanted to share this to the community


This is not from me, just took the reddit one

https://cdn.discordapp.com/attachments/490143667038715906/516704618617634819/Super_Lan_Play_Exposed_1.html

And here, a chat with community influencer Cubuss, giving us more info

https://i.imgur.com/1ghJnbW.jpg

“Do you have TeamViewer?

no i dont use software that scammers use.“

That right there tells me you don’t know what you’re talking about, TeamViewer is just a software taken advantage of by scammers, not a scam program. In fact, they started adding a warning message to any connection from an Indian IP. Scammers also use Chrome/Firefox, do you not use those programs because of it? Now i’m not saying that it isn’t a virus, it very may well be, but you don’t seem to be the right person to accuse that.

 

[LUCKASS]

“Do you have TeamViewer?

no i dont use software that scammers use.“

That right there tells me you don’t know what you’re talking about, TeamViewer is just a software taken advantage of by scammers, not a scam program. In fact, they started adding a warning message to any connection from an Indian IP. Scammers also use Chrome/Firefox, do you not use those programs because of it? Now i’m not saying that it isn’t a virus, it very may well be, but you don’t seem to be the right person to accuse that.

Do you realize that I'm not the guy that discussed that with him?

 

[Joom]

So, just to make sure I am getting this right.

You don't trust sites like virustotal and to "debunk" the results on that site you post a link to another site using highly outdated malware definitions under the premise it gives us "detailed reports"

Yes, because again, AV definitions can't really be trusted. I suggest you study up on crypters (and I don't mean public obfuscation software). What if there were absolutely no detections at all? Would any of you actually further analyze the binary? In this scenario, the author used a common packing and obfuscation method used by malware for years. All detections are purely heuristic signatures. The binary makes no drops, doesn't hook suspiciously, only contacts GitHub and grabs WinPCAP. These actions alone are enough to set off an AV since remote files are accessed and downloaded silently. It takes a bit of nuance, not scantime results, to understand what is and isn't malicious.

 

[D3fau4]

wow, I'm careless of this post and you're already calling me a swindler. XD