mremoteNG machine learning false positive for PuTTYNG

[boneill81]

Hi,

I believe an update to the definitions has resulted in a false positive today. A machine learning warning was thrown by MB today for a file which has been on my PC for quite a long time. My PC is scanned regularly and no errors/detections have ever been thrown for the same file by either MB, Windows Defender or by Microsoft Safety Scanner. The file in question is referred to here: https://github.com/mRemoteNG/PuTTYNG. The home link for mremoteNG is here: https://github.com/mRemoteNG/mRemoteNG.

The issue in question seems similar to past false postiives in other programs related to putty.

https://forums.malwarebytes.com/topic/267033-false-positive-on-putty-portable-from-chocolatey-malwareai/

https://forums.malwarebytes.com/topic/261586-putty-installer/

Thanks,

Barry.

LOG FIle

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 06/04/2021
Scan Time: 09:02
Log File: 6d18f7dc-96ae-11eb-a33e-0250f27e0200.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1217
Update Package Version: 1.0.39143
Licence: Premium

-System Information-
OS: Windows 10 (Build 19042.906)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 549497
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 26 min, 48 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Malware.AI.1578313331, C:\PROGRAM FILES (X86)\MREMOTENG\PUTTYNG.EXE, No Action By User, 1000000, 0, 1.0.39143, 98372422CCE5E4D85E132673, dds, 01189819, 4B72D2A0D937D678AA5C89DF45A58A6E, FE4748B5B538933442C5681F126090F87E56AA1F6907FEA0C480497B9E4EE4A6

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[miekiemoes]

Hi,

This is indeed a false positive by our additional machinelearning engine we have implemented.
This will get fixed.

Thanks for reporting!

[boneill81]

Super, Thanks for the quick response.

Barry.