cod.exe flagged as a Trojan for outbound connection

[bizzio]

I was alerted that an outbound connection made by cod.exe was blocked, and as a result cod.exe has been marked as a Trojan. 

Check the screenshots

139.180.175.197

Path: C:\Program Files (x86)\Call of Duty\_retail_\cod.exe

Is it a false positive?

 

[blender]

Hello,

The IP is hosting this file: 
https://www.virustotal.com/gui/file/f93cbc0cde7bf68cf16add774102d5bff86930b567ff804dc77ad12c9f5a945d/detection

So no - the IP block is not a false positive. It looks too that only malware is communicating with that IP. Makes me curious about the file of yours in question.

Did you download it from a reputable source?
Would you zip/attach a copy of that cod.exe?

[bizzio]

The file is too large.

https://we.tl/t-OrXEQq1inT

It's a copy of the original executable file of Call Of Duty

 

Path C:\Program Files (x86)\Call of Duty\_retail_\cod.exe

[blender]

Hello,

Sorry for delay. I was off yesterday.

Thanks for the file. It is indeed clean. 
I don't think we'll be unblocking that IP until they clean up their scripts. If you don't feel it is a risk though given it is the game connecting and you are not downloading scripts from there, you can allow it.

Open MBAM > settings gear >> allow list >> add >> "allow an application to connect to the internet" >> Browse to the location of your cod.exe so the entire path shows up, then hit "done".
Should be good to go at that point.

[CogitoErgoSum]

On 10/29/2023 at 12:59 PM, blender said:

Hello,

The IP is hosting this file: 
https://www.virustotal.com/gui/file/f93cbc0cde7bf68cf16add774102d5bff86930b567ff804dc77ad12c9f5a945d/detection

So no - the IP block is not a false positive. It looks too that only malware is communicating with that IP. Makes me curious about the file of yours in question.

Did you download it from a reputable source?
Would you zip/attach a copy of that cod.exe?

I had the same issue with this file, and as a result, I encountered problems while playing Call Of Duty because they were investigating my account. I resolved it by changing the SSD, and I haven't had any further issues. Having learned that there are illegal software programs that allowed me to cheat while playing, and having used them only once for testing, could these software programs be responsible for infecting my cod.exe? 

The attack blocked by my antivirus came from a similar IP containing Cobalt Strike C2s

[blender]

@CogitoErgoSum I suppose it is possible...

Using cheats, cracks, etc (even for testing) does come with risks. Some are clean and simply does the job one is after but some come bundled with malware. Often the sites that host such software are ridden with malicious stuff.