Toniq RPM Point Of Sales (POS) Software

[AlexLeadingEdge]

Hi guys,

Just had one of the data extraction elements of RPM quarantined, and the registry key associated with it.

Malware.AI.1361592252    Reg, Value    Malware    Quarantined    HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\RPM\BIN\RPM_DATAEXTRACT.EXE
Malware.AI.1361592252    File    Malware    Quarantined    C:\RPM\BIN\RPM_DATAEXTRACT.EXE

Running it through VirusTotal there are 6 out of 69 vendors that flag it as a trojan, but it has been sitting on this machine for 13 years (2008) so I believe it is most likely a false positive.

https://www.virustotal.com/gui/file/7ef5fe6d8555252f6677c420b94da27d566b64f786b773ebcd58e8f3c4f856ab/detection

RPM_DataExtract.zip

Edited May 27, 2021 by AlexLeadingEdge

[cli]

Thanks for reporting, this will be fixed in 10 minutes. 

[AlexLeadingEdge]

Thanks cli.

How do you determine if a file is good (or not)?

[cli]

Look at the file statically and dynamically plus considerations like how old the file is, VT and other analysis sites, etc. 

[AlexLeadingEdge]

Just had another hit. Same software, different version, also flagged as a trojan:

https://www.virustotal.com/gui/file/dcdbc648dcbf6be3f3328fdc9a899aa77195dd89c7b6a768dc7d9096a53c08ae/detection

RPM_DataExtract.zip

[cli]

Thanks for reporting, this will be fixed in 10 minutes.