Trojan infected Serial studio

[Vital197]

I´m writing this email to rise attention of community because I got trouble in the moment of instalation of the product. In that moment my computer was almost frozen completely and also, I never got to work the program properly. Recently I saw many extra files in every new folders created by Processing. Between these files I saw Serial Studio and I checked this one with https://www.virustotal.com/gui/home/upload this websites. Their antivirus found some trojan Win32. exe https://www.virustotal.com/gui/file/4669b952bcd6ea7056a1603ddaa73d42adfeb2d7e4954bca095ae8b3c5143b3d. I´m sending this email to community to rise their attention.

Also my computer begun to work very slowly.

[alex-spataru]

Hi Vital197!

Thanks a lot for the report. I'm sorry to see that some antivirus programs detected this software as a trojan. I am not sure why this happened. And I'll take the necessary steps to fix this.

I can assure you that as an open-source developer publishing my hard work with my real name, I don't have any intention of participating in this kind of activities.

All builds are generated on GitHub's CI server for the following reasons:

• In the case that my system is infected, I don't want to propagate any virus further
• All users can see and verify the build process
• Also, CI builds allow me to ensure that the application is able to compile on vanilla setups

You can check the build script for each operating system here:

• https://github.com/Serial-Studio/Serial-Studio/blob/master/.github/workflows/deploy.yml

The installers are automatically uploaded from GitHub's CI server to the releases page, no download or extra processing is done by me.

I invite you to check the source code, the installer scripts and everything else. Probably this is a false positive emitted by the antivirus because this software interacts with many hardware peripherals (serial, bluetooth, network, etc).

Also, there could be the possibility that the download sources used for generating the installer (e.g. Qt, NSIS, etc) have been compromised, I'll take a look at it later this evening. Please let me know if I can help with anything.

Finally please only download Serial Studio from the GitHub releases page. I don't have any control or say over other software distribution websites!

This includes SourceForge which for some reason listed my software there and mirrored this repo without my permission or any kind of notification. You must be very careful while downloading open-source software from non-official distribution channels, for example, check this article about GIMP & SourceForge.

[alex-spataru]

Hi! Quick update, I uploaded a copy of SerialStudio.exe (not the installer) and no antivirus flagged the software as malicious. The AV flags another file (e.g. a library) or the installer itself. I'll check each file one by one and get in touch with the vendors to see what can be done.

[alex-spataru]

Also, @Vital197 if possible, please share a preview of the folders that where affected by Serial Studio. I want to check if that's normal behavior, a bug, or something worse. Again, thanks a lot for your report.

[alex-spataru]

As a side note, I think that from now on it should be good practice for me to add the MD5 hashes of each installer/release. If someone wants to lucrate with the work of others, at least we will be able to differentiate between a rouge installer or the ones that are uploaded here.

[alex-spataru]

Update, here is the graph of the files associated with the installer that you scanned:

There are two suspicious things that happen:

• For some reason, the NSIS installer directly contacts an IP from Ireland (20.82.210.154) that seemingly belongs to Microsoft. I don't know why this happens.
• The installer creates/bundles a file named UN_A.exe which is flagged by Jiangmin as Trojan.PSW.Python.fd.

At first, I though that UN_A.EXE was the uninstaller. However, I uploaded the uninstall.exe file from a fresh install and whilst they had similar sizes, they have different hashes and resulted with different scan positives (Suspicious.low.ml.score from Trapmine). It is possible that NSIS generates the uninstaller on the fly, however, we need to check if that is the case.

🚩 Important note: I also downloaded a copy from GitHub releases and uploaded it to VirusTotal. The hashes of the scanned installer and the one that I just uploaded are exactly the same.

[alex-spataru]

Another update: I don't want to rescan the SerialStudio-1.1.7-Windows.exe file until we ensure that the makensis.exe used by GitHub is safe. However, I uploaded the installer of an older release (1.1.6) and only Trapmine detects the installer as suspicious. Both Jiangmin and Palo Alto Networks have been updated to avoid detecting false positives.

[alex-spataru]

Expanding the details of the Un_A.exe file things get more worrying. It contacts the following IP on the local network:

Surprisingly, expanding the installer file with the Unarchiver does not reveal the Un_A.exe file. The file also contacts another IP address from Microsoft (20.62.24.77). Here is the graph:

And finally, expanding the 192.168.0.53 IP address in the Un_A.exe contained in the installer file reveals the following graph:

@joncloud I am using your GitHub Action to generate the NSIS installer for this project. Do you have any knowledge of this? Or do you know who should we contact in order to clarify this behavior?

[kichik]

After thinking about it some more, you probably want to confirm the hashes of all the files under Stubs and Plugins too if you have concerns. The uninstaller code comes from Stubs and packaged up by makensis. Whatever nsh files you're using probably could use verification too. I doubt you will find anything because this looks exactly like all the other false positives. But if you want to be completely sure, it can't hurt. Maybe with something like https://idrassi.github.io/DirHash/

[Vital197]

Hi Alex and community,

thank you so much for all your replies and help. Sorry for my delay I got so busy and also sad with this virus which I got from the installer. Again I want to point out why I thought that problem was related to Serial Studio. First of all, my computer was frozen in time of instalation Serial Studio, I can tell that it was something unusual. Secondly, in new created folders for new Processing sketch I have file named "Serial Studio 1.1.7.exe". That are two reasones why I thought that problem in the installer.
Almost one week I try two fight with this problem and it still there. In this moment I can not continue with my Processing and Arduino project.
Usualy I try to download files from safe sources and this case I believe it was dowloaded from gitHub But believeme that I really careful with that and I have enough experience with it. Also I can suspect my processing installer but that I got from processing.org.
I tried to check my sistem with Kaspersky antivirus but it can not find anything. I will try to check with external disk and with different antiviruses.
I try to put here screeenshot of infected Processing folder. In this folder you can see bunch of diferrent files which does not have relation to *.pde file.

I´m not sure that I was able to dowload my screenshort of infected folders. Please let me know if that case and we will try to find some another way to show you infected folders.

[Vital197]

I see that it works. So now you can see my infected folders.

[alex-spataru]

Hi @Vital197! Again sorry for the bad experience, I have checked the installers, talked with AV vendors and we have confirmed that indeed the NSIS installer was detected as a false positive. Here is a more detailed explanation for this from the official website of NSIS.

First of all, my computer was frozen in time of instalation Serial Studio, I can tell that it was something unusual.

I think that this could be related to the Microsoft Visual C++ redistributable installer that is called automatically during the installation of Serial Studio. The Visual C++ redistributable installs the compiler runtime needed to be able to run the MSVC-compiled version of Serial Studio.

I don't know if using Windows 7 would affect the installation of the Visual C++ redistributable package, as this operating system is not supported anymore by Microsoft. I think that there could be a chance that the Visual C++ redistributable installer got stuck during the installation process.

I have already done tests on a Windows 7 SP1 (build 7601) VM and I did not experience any issues. I think that there is a probability that your computer catched the virus from elsewhere and somehow it placed the Serial Studio installer (plus a bunch of other files) in your Processing folder.

I would really recommend you to upgrade to Windows 10 or Windows 11, since Windows 7 (unfortunately) does not receive security updates anymore, here is Microsoft's stance:

If you continue to use Windows 7 now that support has ended, your PC will still work, but it will be more vulnerable to security risks and viruses. Your PC will continue to start and run, but will no longer receive software updates, including security updates, from Microsoft.

I use Windows 7 for interacting with several proprietary motor controllers/drivers for my thesis. However, I do this from a VM with read-only access to my primary operating system. This way, I can still run legacy software, and interact with specialized hardware while mitigating any possible security issues.

[alex-spataru]

Also, if needed. Feel free to send me a private e-mail to schedule a Zoom call to check what is happening with your Serial Studio installation. Spanish is my native language :)