ZeroMQ likely false positive

[iago-lata]

ZeroMQ packages several prebuilts binaries for node.js and their windows 32 bit (win32-ia32) is being flagged as a Trojan, which is very likely to be a false positive. Please evaluate this.

prebuilds.zip

[iago-lata]

github: https://github.com/zeromq/zeromq.js/tree/master
npm: https://www.npmjs.com/package/zeromq

[cli]

Can you attach the detection log? Thanks.

[AdvancedSetup]

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location @iago-lata

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

 

[hrivks]

Hi, I ran into this as well.

Here is my detection log

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 12/22/23
Scan Time: 1:12 PM
Log File: a3b61974-a0f5-11ee-91cf-9c2dcd088f57.json

-Software Information-
Version: 4.6.7.301
Components Version: 1.0.2222
Update Package Version: 1.0.78729
License: Trial

-System Information-
OS: Windows 11 (Build 22631.2861)
CPU: x64
File System: NTFS
User: Hari-P16s\hari

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 1
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 0 min, 25 sec

-Scan Options-
Memory: Disabled
Startup: Disabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Trojan.MalPack.RND.Generic, C:\USERS\HARI\CODE\TEST\NODE_MODULES\ZEROMQ\PREBUILDS\WIN32-IA32\NODE.NAPI.GLIBC.NODE, No Action By User, 9206, 1205790, 1.0.78729, , ame, , 3630879E9AE8C0DC246FC8CCF5176CBA, 4918C83060A43152CD5D767DC37DD8964BA201543DFC0A458834723E36E10747

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Also, the contents of `a3b61974-a0f5-11ee-91cf-9c2dcd088f57.json` are:

767D909B8D5CAEDCD080731023FCFBBF019AA347418D1C90E4FE074BBE36D674
{
   "applicationVersion": "4.6.7.301",
   "chromeSyncResetQueryRequested": false,
   "chromeSyncResetQueryResult": false,
   "clientID": "MbamUI",
   "clientType": "rightClickUIScan",
   "componentsUpdatePackageVersion": "1.0.2222",
   "coreDllFileVersion": "3.0.0.1403",
   "cpu": "x64",
   "dbSDKUpdatePackageVersion": "1.0.78729",
   "detectionDateTime": "2023-12-22T18:12:16Z",
   "fileSystem": "NTFS",
   "id": "a3b61974-a0f5-11ee-91cf-9c2dcd088f57",
   "isLargePEEnabled": false,
   "isUserAdmin": true,
   "largePEMaxSize": 2147483647,
   "licenseState": "trial",
   "linkagePhaseComplete": true,
   "loggedOnUserName": "Hari-P16s\\hari",
   "machineID": "",
   "os": "Windows 11 (Build 22631.2861)",
   "schemaVersion": 22,
   "sourceDetails": {
      "aggressiveMode": false,
      "clientMetadata": {
         "jobId": "",
         "scheduleId": "",
         "scheduleTag": ""
      },
      "ddsigEnabled": true,
      "filesScannedByIG": 0,
      "objectsScanned": 1,
      "scanEndTime": "2023-12-22T18:12:41Z",
      "scanOnlineStatus": "online",
      "scanOptions": {
         "pumHandling": "detect",
         "pupHandling": "detect",
         "scanArchives": true,
         "scanFileSystem": true,
         "scanMemoryObjects": false,
         "scanPUMs": true,
         "scanPUPs": true,
         "scanRookits": false,
         "scanStartupAndRegistry": false,
         "scanType": "custom",
         "useHeuristics": true
      },
      "scanResult": "completed",
      "scanStartTime": "2023-12-22T18:12:16Z",
      "scanState": "completed",
      "shurikenEnabled": true,
      "type": "scan"
   },
   "threats": [
      {
         "ddsSigFileVersion": "",
         "linkedTraces": [

         ],
         "mainTrace": {
            "ImpersonationSid": "",
            "archiveMember": "",
            "archiveMemberMD5": "",
            "cleanAction": "quarantine",
            "cleanContext": {
            },
            "cleanResult": "notStarted",
            "cleanResultErrorCode": 0,
            "cleanTime": "",
            "generatedByPostCleanupAction": false,
            "hubbleRequestErrorCode": 0,
            "id": "a4d7611e-a0f5-11ee-8fd1-9c2dcd088f57",
            "igExitCode": "",
            "isPEFile": true,
            "isPEFileValid": true,
            "isWhitelistedByAdsInfo": false,
            "linkType": "none",
            "objectMD5": "3630879E9AE8C0DC246FC8CCF5176CBA",
            "objectPath": "C:\\USERS\\HARI\\CODE\\TEST\\NODE_MODULES\\ZEROMQ\\PREBUILDS\\WIN32-IA32\\NODE.NAPI.GLIBC.NODE",
            "objectSha256": "4918C83060A43152CD5D767DC37DD8964BA201543DFC0A458834723E36E10747",
            "objectSize": 547840,
            "objectType": "file",
            "resolvedPath": "C:\\Users\\hari\\Code\\test\\node_modules\\zeromq\\prebuilds\\win32-ia32\\node.napi.glibc.node",
            "rtpEventType": "other",
            "suggestedAction": {
               "archiveDir": false,
               "chromeExtensionOther": false,
               "chromeExtensionPreferences": false,
               "chromeExtensionSecurePreferences": false,
               "chromeExtensionSyncData": false,
               "chromeUrlOther": false,
               "chromeUrlSecurePreferences": false,
               "chromeUrlSyncData": false,
               "chromeUrlWebData": false,
               "disableHubbleWhiteListing": true,
               "disableSignatureWhiteListing": true,
               "fileDelete": true,
               "fileReplace": false,
               "fileTxtReplace": false,
               "folderDelete": false,
               "isChromeObject": false,
               "isDDS": false,
               "isDoppleganging": false,
               "isExternalDetection": false,
               "isPUP": false,
               "isShuriken": false,
               "isWMIEventConsumer": false,
               "killProcess": true,
               "minimalWhiteListing": false,
               "moduleUnload": false,
               "noLinking": false,
               "physicalSectorReplace": false,
               "priorityHigh": false,
               "priorityNormal": false,
               "priorityUrgent": false,
               "processUnload": false,
               "regKeyDelete": false,
               "regValueDelete": false,
               "regValueReplace": false,
               "shortcutReplace": false,
               "silentMode": false,
               "singleDelete": false,
               "testingMode": false,
               "treatAsRootkit": false,
               "useDDA": false,
               "verifyResolvedPath": true,
               "whitelistCheckError": false
            },
            "winVerifyTrustResult": {
               "expectedError": false,
               "lastErrorCode": 0,
               "wvtCalled": false,
               "wvtResult": 0
            }
         },
         "ruleID": 1205790,
         "ruleString": "",
         "rulesVersion": "1.0.78729",
         "srcEngineComponent": "ame",
         "srcEngineThreatNames": [

         ],
         "threatID": 9206,
         "threatName": "Trojan.MalPack.RND.Generic"
      }
   ],
   "threatsDetected": 1
}

 

MalwareBytes - Zeromq detection.txt a3b61974-a0f5-11ee-91cf-9c2dcd088f57.json.txt

[blender]

Thank you @hrivks for the logs. This should no longer be detected.
 

@iago-lata The file you attached did not get detected locally and the rule involved with hrivls logs did not match your attached file so if you can attach logs as advised please if you are still getting a detection.

Thanks!