RAdmin 3.4 executable picked up as Malware.AI.4293425028

[AlexLeadingEdge]

Hi guys,

We are seeing 

C:\USERS\REDACTED\APPDATA\LOCAL\DOWNLOADED INSTALLATIONS\{ECF6FE39-A8B0-411B-83AC-75A17875FE6F}\RSERV34.MSI

It is a remote access tool that our client uses to access all the point of sale machines. This is a tough one, given it could probably be abused, but so could other remote access tools such as TeamViewer, and TeamViewer isn't detected as malware.

Can an admin please let me know who wants to take a look at this and I will upload log files to that person.

[AlexLeadingEdge]

Hi guys,

Just a quick update, the latest version is 3.5.2 and all their machines are on that version, so it looks like it is a leftover install file of no importance to the client.

Edited March 22, 2021 by AlexLeadingEdge

[TwinHeadedEagle]

@AlexLeadingEdge Do you still get the detection?

[AlexLeadingEdge]

12 hours ago, TwinHeadedEagle said:

@AlexLeadingEdge Do you still get the detection?

I released it, scanned the computer again and the file was picked up again.

Edited March 22, 2021 by AlexLeadingEdge