|
|
2026-06-16 205213.png (115,381 bytes) |
|
|
Antiviruses are, generally speaking, rubbish. They will annoy you endlessly with false positives and then let the real threat in when you least expect it. Read the Behavior page of your report, it's hilarious: Checks for available system drives (often done to infect USB drives)Of course we do. We show them in Disk menu, Alt+F1/F2. Creates a process in a suspended state, likely for injectionOf course we create processes. Duh. And yes, we create them in a suspended state to understand whether we need to wait for their termination. Queries process token information to check for Administrator privileges or UAC elevation statusYes, we do support elevated operations. Yes, we check first. Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keyingYes, we show all this information in Info Panel, Ctrl+L. Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption softwareYes, we can encrypt and decrypt files, if that's what the user wants. Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbookYes, we show them in Disk menu and in Hotplug list. And then "Crowdsourced Sigma Rules" complains about msiexec functionality, which is part of Windows. Facepalm. These checks are by clowns and for clowns, what else to say. Any product slightly more complex that "Hello World" will inevitably trigger some. However, it's totally fine to have doubts and trust no one. You can try github releases as an alternative: https://github.com/FarGroup/FarManager/releases You can try 7z instead of msi. You can compile the binaries from scratch if you want ultimate safety. Or you can try contacting those vendors and asking them to update their exclusion databases or whatever. |
- Anonymous
