Malware detected in update

Hello.

Our Anti-virus / XDR has flagged an update to R Studio on his computer as a security threat.

VirusTotal also has some scans reporting a risk:

Avira (no cloud)

PHISH/KAB.Talu.rpasg

Cynet

Malicious (score: 99)

GData

PDF.Trojan.Agent.M4PVR1

Google

Detected

Ikarus

Trojan.PDF.Agent

WithSecure

Phishing.PHISH/KAB.Talu.rpasg

Has this been experienced by others ? Here is the information concerning the reported malicious file :

Hostname: LAPxxxxxxxxxx

Host Ip: 192.168.1.90

OS Version: Windows 10 Enterprise x64 22H2

CynetEPS Version: 4.20.1.13727

Configuration Version: 638598531000000000

Incident detected on (Host Timezone): 2024-08-22T14:15:52.997

Incident detected on (UTC): 2024-08-22T18:15:52.997

Alert Name: Detection Engine - Malicious Binary - Infected File - File Dumped on the Disk

EPS Prevention: true

EPS Prevention Success: Success

Extra Info

Related Process Occurrence Id: 00000000-0000-0000-0000-000000000000

Process Cert Trust Result: -2146762496

Related Parent Process Occurrence Id: 5B5EA04C-BFF4-DA01-C41B-0000584DE9A8

Parent Cert Trust Result: -2146762496

Grandparent Cert Trust Result: -2146762496

Desired EPS Prevention: Rename File, Block Access

Actual EPS Prevention: Rename File, Block Access

Detection Time UTC: 2024-08-22 18:15:52

Detection Time Local: 2024-08-22 14:15:52

Detection Engine: Cynet AV

Infected file: C:\Users\xxxxxxx\AppData\Local\Temp\RtmpIROR1J\downloaded_packages\Rcpp_1.0.13.zip

Malware Type: phishing

Malware ID: PHISH/KAB.Talu.rpasg

Description: 0

ave version: 8.3.70.38

avpack version: 8.6.2.38

vdf version: 8.20.32.132

vdf date: 22.8.2024

Remediation Status: File C:\Users\xxxxxxx\AppData\Local\Temp\RtmpIROR1J\downloaded_packages\Rcpp_1.0.13.zip Renamed to .cynet extension

Infected file SHA256: FB3A389182A64F33BA484EB9ED0FB59EF0EC6619C5D7157EAEAFD5BA870C0A67

Parent Process Details

Process SHA256: 86D171F50C0E5C83CF327FD9507F3215793E3A9A41A1A61834957442D98D74EA

Process PID: 7108

Process Running User: cmq\jmorneau

Process Running User SID: S-1-5-21-1616904548-1971603713-444732941-3875

Process Path: c:\program files\rstudio\resources\app\bin\rsession-utf8.exe

Process Params: "C:/Program Files/RStudio/resources/app/bin/rsession-utf8.exe" --config-file none --program-mode desktop --www-port 16403 --launcher-token e63ca7e6

Process is signed: Not signed

Process CreationTime: 2024-08-22 14:15:42.236

Grandparent Process Details

Process SHA256: 22475A54D42403F45E22C604DD944CEF8278555A7DF70151078E331BF11CFD00

Process PID: 8804

Process Running User: cmq\xxxxxxxxxx

Process Running User SID: S-1-5-21-1616904548-1971603713-444732941-3875

Process Path: c:\program files\rstudio\rstudio.exe

Process Params: "C:\Program Files\RStudio\rstudio.exe"

Process is signed: Not signed

Process CreationTime: 2024-08-22 14:14:34.235

Incident received on: 2024-08-22T18:15:53.1+00:00

Incident received on (UTC): 2024-08-22T18:15:53.1Z

Thanks

Hello, that file is not part of RStudio.

It is the file of a binary R package, that can be obtained from many package mirrors. E.g. https://cran.r-project.org/bin/windows/contrib/4.4/Rcpp_1.0.13.zip.

Maybe your user knows where they got it from. E.g. which R version and which package mirror are they using?

As far as I can tell the SHA256 of the infected file does not match with the files available on the central CRAN mirror at https://cran.r-project.org

Thanks Gabor for the help.

I have advised my user.

Eric Garneau