Trojan virus suspected in SQLiteStudio

[jipehache]

Details

I'm using Malware Antimalwarebyte antivirus and the lastest planned verification seems to have detected trojans in some parts of your code. Below the report of my antivirus

Steps to reproduce

nothing

Operating system

Windows 11

SQLiteStudio version

SQLiteStudio 3.4.1.

Report of my antivirus

Malwarebytes
www.malwarebytes.com

-Détails du journal-
Date de l'analyse: 12/07/2023
Durée d'analyse: 16:46
Fichier journal: ec25ad40-20c2-11ee-a776-90e8687ccdbe.json

-Informations du logiciel-
Version: 4.5.31.270
Version de composants: 1.0.2047
Version de pack de mise à jour: 1.0.72299
Licence: Premium

-Informations système-
Système d'exploitation: Windows 11 (Build 22621.1928)
Processeur: x64
Système de fichiers: NTFS
Utilisateur: System

-Résumé de l'analyse-
Type d'analyse: Analyse des menaces
Analyse lancée par: Planificateur
Résultat: Terminé
Objets analysés: 338158
Menaces détectées: 3
Menaces mises en quarantaine: 0
Temps écoulé: 6 min, 20 s

-Options d'analyse-
Mémoire: Activé
Démarrage: Activé
Système de fichiers: Activé
Archives: Activé
Rootkits: Désactivé
Heuristique: Activé
PUP: Détection
PUM: Détection

-Détails de l'analyse-
Processus: 0
(Aucun élément malveillant détecté)

Module: 0
(Aucun élément malveillant détecté)

Clé du registre: 0
(Aucun élément malveillant détecté)

Valeur du registre: 0
(Aucun élément malveillant détecté)

Données du registre: 0
(Aucun élément malveillant détecté)

Flux de données: 0
(Aucun élément malveillant détecté)

Dossier: 0
(Aucun élément malveillant détecté)

Fichier: 3
Trojan.MalPack, C:\PROGRAM FILES\SQLITESTUDIO\EXT\IEEE754.DLL, Aucune action de l'utilisateur, 168, 1163687, 1.0.72299, , ame, , 29E8730B9FF902E6E1058924BD53BCB3, 47527BB8D9EEEDAEB8FF769B115FE3B8613E5551DF25A22A715F950FC828FC9A
Trojan.MalPack, C:\PROGRAM FILES\SQLITESTUDIO\EXT\ZORDER.DLL, Aucune action de l'utilisateur, 168, 1163687, 1.0.72299, , ame, , 70A2EB2BF6DC14F2CDDC561A4ADC90C1, 89CB5C6646A1A5FAF38974B4BB15059AEEC61A03569E8CC602E60B496077896C
Trojan.MalPack, C:\PROGRAM FILES\SQLITESTUDIO\EXT\EVAL.DLL, Aucune action de l'utilisateur, 168, 1163687, 1.0.72299, , ame, , 34156BB5BAA732AD38FAAA8F7F041F0D, 5DA5ED086BBA11507239B6F241F24A771A5B69D2E95137C0079BEE9BEE6B988B

Secteur physique: 0
(Aucun élément malveillant détecté)

WMI: 0
(Aucun élément malveillant détecté)

(end)

[tuffnatty]

@jipehache Trojan.MalPack seems to be a label for the antivirus heuristic "The code seems to be packed, and I don't know the algorithm". I don't think the files installed from the official SQLiteStudio distribution are packed in any way. This can be a misdetection, or the files got infected on your machine. Try uploading them to VirusTotal and let all the detection engines analyze them and you'll have a much better idea if it is a problem or false positive.

[pawelsalawa]

I think they are just false positives.
Files listed in the report are compiled on GitHub hosted runner and then are provided for download also from GitHub, so pretty unlikely to get infected there.
These files are compiled from open source code available online, so no intended harmful code there either.

[OsrsMerchant]

I woke up to the same thing today

[srtmichael]

Same here; Windows 11. I quarantined them. Sqlite Studio still launched and runs, so I'm curious.

[stanschim]

Same problem with Windows 10 and SQLiteStudio 3.4.4

[pawelsalawa]

I've already described above that it is most likely false positive. Anyway, you can remove these files if you want. They are not critical. These are just loadable SQLite extensions (available at official SQLite page).

[srtmichael]

I agree that 'most likely' is the 'most likely' answer; but in this age where malware and trojans can be injected into DLLs at the pre-publish stage on a development build server, it's critical to know for certain.

If SqLiteStudio comopnents are redistributed with a commercial enterprise application and the end customer fails a security scan, there could be fallout.

Would digital signatures on the various components be viable to ensure the source build location was not compromised?

Thanks!

[jipehache]

I sent a ticket to malwarebytes support to do a thorough search

[srtmichael]

fantastic, thanks!

[jipehache]

Here is the answer by Malewarebytes support :

Jean-Paul

Rocco De Salvo (Support)

Jul 13, 2023, 11:14 PDT

Hello,

Thank you for contacting Malwarebytes Support. My name is Rocco. I'll be assisting you with ticket number 4311014.

This was a False Positive that has been fixed. If you are still seeing this block:

Open Malwarebytes and click the gear icon in the upper right corner to open Settings.
Click Check for Updates and let me know if you're still seeing the block.

If you need to restore the items, refer to: Restore or delete quarantined items in Malwarebytes for Windows

Regards,
Rocco D. | Malwarebytes Support | support.malwarebytes.com