Results 1 to 4 of 4

Thread: Whalebird start menu shortcut detected as malware

  1. #1
    Junior Member IzNoGud78's Avatar
    Join Date
    Jan 2023
    Location
    Italy
    Posts
    4

    Default Whalebird start menu shortcut detected as malware

    The file
    Code:
    C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Whalebird.lnk
    is in fact detected as TangoDialer.

    It's described as an Autostart file in the Dialer-001 category, having rule ID CE8E2812 and a rather high level of danger.

    Whalebird is an Electron based Mastodon, Pleroma and Misskey client. It's multiplatform and open source (source code is available on the project's github page h3poteto/whalebird-desktop).

    I don't understand why only the shortcut on the start menu is detected as malware, by the way I have tried to recreate the shortcut myself, but it is still detected. At the moment I've seen fit to ignore the item because in my opinion it may be a false positive.

  2. #2
    Junior Member IzNoGud78's Avatar
    Join Date
    Jan 2023
    Location
    Italy
    Posts
    4

    Default

    I forgot to mention that there aren't options or additional commands on the shortcut destination string that would suggest malicious behavior.

    The path specified is as follows and only invokes the executable file of the program
    Code:
    C:\Users\<Username>\AppData\Local\Programs\Whalebird\Whalebird.exe

  3. #3
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,601

    Default

    Thanks for reporting this.

    Rule CE8E2812 doesn't seem to match here on first look.

    I applaud that you've hidden your username on a public post - does it by chance consist of an
    adjective and a noun, 8 letters in total?

    Dialers are quite old rules, this is one of the very few that have a very basic testing of the linked file.

    PS: received confirmation that this rule will be improved. One of our forensics is going to test the software anyway
    Last edited by PepiMK; 2023-02-08 at 10:23.
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  4. #4
    Member of Team Spybot (m/f)'s Avatar
    Join Date
    Feb 2006
    Posts
    294

    Default

    The rules that caused this FP have just been updated and published. This issue should be solved, if not, let us know IzNoGud78. Thank you.
    (m/f)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •