This message was deleted.

This page requires a VT Intelligence subscription to access.

Yes, you can sign up (no cost). I was sent this link from the security team and had to sign up myself.

https://analyze.intezer.com/analyses/1d1b36e4-740a-4ad9-8e63-9a7539357845/sub/671fd15f-db70-434a-89ab-42c3c675a8fb/string-reuse intezer flags two strings as malware, are those what you are talking about?

yes, i believe it is the strings section that is being flagged as malware.

The two strings in question are from two entirely different malware... Intezer themselves passes the binary as trusted, so Google and Ikarus are being overly paranoid. Also Intezer cached a 3rd vendor flagging the binary as malware from VT but the third apparently doesn't flag it anymore.

it doesn’t have malware in it, I promise

I'd just say overly paranoid

@creamy-pencil-82913 In the link you posted,

bash

isn’t explicitly called out as a file that is flagged as a false positive. this is the file that is in question by our security team.

Better have a false positive than false negative...

yes that is just called out as one that is commonly flagged. Doesn’t mean its the only one. We’ve also seen iptables, ipset, bash, all kinds of stuff. garbage.

@acoustic-sunset-13848 If you're in a ITIL company (my condoleances), good luck getting the security clearance/override from your security team

Not ITIL, but we want to make sure that our customers are protected.