Hello.
Our Anti-virus / XDR has flagged an update to R Studio on his computer as a security threat.
VirusTotal also has some scans reporting a risk:
Avira (no cloud)
PHISH/KAB.Talu.rpasg
Cynet
Malicious (score: 99)
GData
PDF.Trojan.Agent.M4PVR1
Detected
Ikarus
Trojan.PDF.Agent
WithSecure
Phishing.PHISH/KAB.Talu.rpasg
Has this been experienced by others ? Here is the information concerning the reported malicious file :
Hostname: LAPxxxxxxxxxx
Host Ip: 192.168.1.90
OS Version: Windows 10 Enterprise x64 22H2
CynetEPS Version: 4.20.1.13727
Configuration Version: 638598531000000000
Incident detected on (Host Timezone): 2024-08-22T14:15:52.997
Incident detected on (UTC): 2024-08-22T18:15:52.997
Alert Name: Detection Engine - Malicious Binary - Infected File - File Dumped on the Disk
EPS Prevention: true
EPS Prevention Success: Success
Extra Info
Related Process Occurrence Id: 00000000-0000-0000-0000-000000000000
Process Cert Trust Result: -2146762496
Related Parent Process Occurrence Id: 5B5EA04C-BFF4-DA01-C41B-0000584DE9A8
Parent Cert Trust Result: -2146762496
Grandparent Cert Trust Result: -2146762496
Desired EPS Prevention: Rename File, Block Access
Actual EPS Prevention: Rename File, Block Access
Detection Time UTC: 2024-08-22 18:15:52
Detection Time Local: 2024-08-22 14:15:52
Detection Engine: Cynet AV
Infected file: C:\Users\xxxxxxx\AppData\Local\Temp\RtmpIROR1J\downloaded_packages\Rcpp_1.0.13.zip
Malware Type: phishing
Malware ID: PHISH/KAB.Talu.rpasg
Description: 0
ave version: 8.3.70.38
avpack version: 8.6.2.38
vdf version: 8.20.32.132
vdf date: 22.8.2024
Remediation Status: File C:\Users\xxxxxxx\AppData\Local\Temp\RtmpIROR1J\downloaded_packages\Rcpp_1.0.13.zip Renamed to .cynet extension
Infected file SHA256: FB3A389182A64F33BA484EB9ED0FB59EF0EC6619C5D7157EAEAFD5BA870C0A67
Parent Process Details
Process SHA256: 86D171F50C0E5C83CF327FD9507F3215793E3A9A41A1A61834957442D98D74EA
Process PID: 7108
Process Running User: cmq\jmorneau
Process Running User SID: S-1-5-21-1616904548-1971603713-444732941-3875
Process Path: c:\program files\rstudio\resources\app\bin\rsession-utf8.exe
Process Params: "C:/Program Files/RStudio/resources/app/bin/rsession-utf8.exe" --config-file none --program-mode desktop --www-port 16403 --launcher-token e63ca7e6
Process is signed: Not signed
Process CreationTime: 2024-08-22 14:15:42.236
Grandparent Process Details
Process SHA256: 22475A54D42403F45E22C604DD944CEF8278555A7DF70151078E331BF11CFD00
Process PID: 8804
Process Running User: cmq\xxxxxxxxxx
Process Running User SID: S-1-5-21-1616904548-1971603713-444732941-3875
Process Path: c:\program files\rstudio\rstudio.exe
Process Params: "C:\Program Files\RStudio\rstudio.exe"
Process is signed: Not signed
Process CreationTime: 2024-08-22 14:14:34.235
Incident received on: 2024-08-22T18:15:53.1+00:00
Incident received on (UTC): 2024-08-22T18:15:53.1Z
Thanks