False positive - dash.exe (Cygwin 32-bit)

[swwright]

Anti-Ransomware BETA has flagged "dash.exe" as ransomware and quarantined it.  FYI, Dash is the Debian Almquist Shell, a minimalist alternative to Bash for those who use Unix, Linux, Cywin, or similar.

At the time MBARW quarantined the file, Cygwin was not running.

I am following your procedure for restoring the file and reporting a false positive.  I also scanned the file with MBAM and (for what it's worth) Symantec Endpoint Protection.  Neither found anythying amiss with the dash.exe file.  I therefore conclude that this is a false positive.

Per your procedure, two PK-ZIP archives are attached to this post, one containing a copy of the dash.exe file (48KB), and the other containing a copy of the MBARW log directory (182KB).

Thank you.

dash.zip

logs.zip

[tetonbob]

Hi swwright. Thanks for your report. This file should no longer be detected. If you've added dash.exe to the exclusions in Malwarebytes Anti-Ransomware BETA, please do remove from exclusions and let us know if the issue returns. It should not.

 

Thank you for your participation!

 

[swwright]

Thanks, Bob!

I cleared the exclusion list, and will wait a couple of days and see if it triggers again.  I presume my copy of the software was automatically updated.

It would be nice to have some control, or at least visibility, concerning updates in the final product.

Thanks again for the anti-ransomware product.

[tetonbob]

Hi swwright. Yes, please do monitor the situation for a day or two.

As for a final product, eventually this Anti-Ransomware tech will make it into one of our Malwarebytes Anti-Malware releases. As a standalone, it's intended to be a Beta development platform. When ARW is rolled into MBAM any automatic updates like this will be logged in the program logs for visibility. In ARW, major upgrades are done in the form of a new installer, and the user is notified.

Thanks again for your participation.