mirror of
https://github.com/NickeManarin/ScreenToGif.git
synced 2026-04-25 15:15:51 +03:00
[GH-ISSUE #1264] Crowdstrike antivirus flags ScreenToGif.dll as virus #932
Labels
No labels
copy cats
duplicated
future feature
pull-request
⬜ Accepted
⬜ Completed
⬜ Help Wanted 💪
⬜ In Progress
⬜ Missing Details
⬜ Pending
⬜ Waiting For Answer ⏳
🆕 feature preview
🔷 Bug 🐛
🔷 Out Of Scope
🔷 Out Of Scope
🔷 Question
🔷Enhancement
🔷Enhancement
🔷Invalid / External
🔷Knowledge Base
🔷Won't Fix
🕑 High
🕑 High
🕑 High
🕕 Medium
🕙 Low
🕛 Critical
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/ScreenToGif#932
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @richardsjogren on GitHub (Dec 14, 2023).
Original GitHub issue: https://github.com/NickeManarin/ScreenToGif/issues/1264
Originally assigned to: @NickeManarin on GitHub.
Crowdstrike antivirus flags ScreenToGif as virus
(Sorry, not sure if it´s ok to report this as a "bug")
Steps to reproduce the behavior:
https://www.virustotal.com/gui/file/95542221c818831363148465643614273f819c08065a0870dade8ddba6edb1ad
@Vincent-FundApps commented on GitHub (Dec 15, 2023):
+1
@TrevisanGMW commented on GitHub (Dec 15, 2023):
+1
@mattspierce commented on GitHub (Dec 18, 2023):
I've had a few user experiencing this. Here are the details of the detection.
DETECT TIME
Dec. 17, 2023 12:48:24
HOSTNAME
computername
HOST TYPE
Workstation
USER NAME
place\user
ACTIONS TAKEN
Process blocked
File quarantined
SEVERITY
Low
OBJECTIVE
Falcon Detection Method
TACTIC & TECHNIQUE
Malware via PUP
TECHNIQUE ID
CST0013
SPECIFIC TO THIS DETECTION
This file is classified as Adware/PUP based on its SHA256 hash.
TRIGGERING INDICATOR
Associated IOC (SHA256 on library/DLL loaded)
ad17b9409ac2b46f54c5fbd220d48d091ca7a1b8d91c20f15b00b93c6f6ca69d
GLOBAL PREVALENCE
Common
LOCAL PREVALENCE
Low
IOC MANAGEMENT ACTION
None
Associated File
\Device\HarddiskVolume6\Program Files\ScreenToGif\ScreenToGif.exe
GROUPING TAGS
None
LOCAL PROCESS ID
26000
COMMAND LINE
"C:\Program Files\ScreenToGif\ScreenToGif.exe"
FILE PATH
\Device\HarddiskVolume6\Program Files\ScreenToGif\ScreenToGif.exe
EXECUTABLE SHA256
ad17b9409ac2b46f54c5fbd220d48d091ca7a1b8d91c20f15b00b93c6f6ca69d
GLOBAL PREVALENCE
Common
LOCAL PREVALENCE
Low
IOC MANAGEMENT ACTION
None
EXECUTABLE MD5
ce227688fe0d35e6b5381666dc1cd7db
RUN PERIOD
START TIME
Dec. 17, 2023 12:47:14
END TIME
Dec. 17, 2023 12:47:15
DURATION
Terminated
@jduke-halls commented on GitHub (Dec 28, 2023):
Just had a trigger with the new version
Steps to reproduce detection:
Metadata from Crowdstrike Detection
VirusTotal has no detections https://www.virustotal.com/gui/file/fe13f363f2c5940eb7010eeee25763575b86d945fa7d70f54c2cce9c4c6f54c6/detection
HybridAnalysis doesn't have a sample: https://www.hybrid-analysis.com/sample/fe13f363f2c5940eb7010eeee25763575b86d945fa7d70f54c2cce9c4c6f54c6
What we did
We created a group in Falcon for those who can run ScreenToGif and tagged the computers to allow an exception to
*\ScreenToGif.exe@NickeManarin commented on GitHub (Jan 5, 2024):
I sent a message to the company, let's see if they give me a reply.
@mcd92 commented on GitHub (Jan 11, 2024):
Same thing here. Antivirus McAfee.
@elliottttttttt commented on GitHub (Jan 18, 2024):
We have the same issue and have asked our CrowdStrike TAM to assist. Hoping that you receive some assistance back from the vendor. In case it's helpful we've raised support case # 01326126 on our end for misidentification as a PUP.
@DavidMulder0 commented on GitHub (Jan 22, 2024):
Tip: When you install through the Microsoft Store it actually works just fine... 😕 No idea what that says about CrowdStrike, but at least a workaround for those who want to use ScreenToGif 👍.
@captainhunt commented on GitHub (Jan 24, 2024):
Well just as long as your company does not block MS store, too 😕.
@chrispy-snps commented on GitHub (Jan 24, 2024):
@NickeManarin - I hope we are able to resolve this. I am impacted too.
@NickeManarin commented on GitHub (Feb 1, 2024):
@mattspierce commented on GitHub (Feb 1, 2024):
I would love for this issue to be resolved. The detection was heuristic. I am curious if this FP submission works with the AI engines or just a hash check. Do we know what was added to the code in mid December that triggered the alerts?
@mattspierce commented on GitHub (Feb 1, 2024):
Also, I did a test with the current version against my CS client and did not get blocked. I will remove the IOC exception and see if my users are impacted.
@NickeManarin commented on GitHub (Feb 1, 2024):
I got this details from some other company, they got these results:
and
YARA Bolonyokte is a really generic rule-set as for example, it matches apps with "CaptureScreen" and "CaptureCursor" which of course this app would have. 🙄
@NickeManarin commented on GitHub (Feb 1, 2024):
I can check, but the code base was mostly unchanged during the last 2 quarters of 2023.
@NickeManarin commented on GitHub (Mar 24, 2024):
This should no longer be a problem, as the company removed the false-positive.
@p1r473 commented on GitHub (May 22, 2024):
@NickeManarin Nope its still flagging for me here as of May 5
Hash
aaa562c84f22ea0fc63d3fef74ee4c4fbb26d873c3b609555e2870008c01c98c