Fuck it, might as well use this as an educational PSA opportunity.
Virus Total itself detects the following about the file:
- zip: no shit it's a zipped archive
- detect-debug-environment: Program can detect and behave differently if launched in debug mode (common during software development, but can also be used by malicious actors to make the program behave different when being inspected for suspicuos activity)
- long-sleeps : Program has functions timed to happen a "long" time after it is launched (normal for periodic auto-saving, updating or license checking, but can also be used to hide a malicous programs true purpose until after the user is comfortable and thinks everything is working normally)
- checks-user-input: Program can check user inputs, potentially even when it is not in focus/use (normal behaviour in games where even when alt-tabbed some things should still be controllable like pause/unpause, sound controls and so on, but can also be used by malicious programs to steal information given to other programs trough keylogging of things like usernames and passwords typed into a browser)
- checks-network-adapters: Program can check network adapters and specifications (normal behaviour for programs that need to contact the internet and or be visible to the internet like dedicated servers, not normal for applications that do not have a valid reason to connect to the internet)
- contains-pe: archive contains portable executable, in other words a program that can be ran directly on a Windows operating system, without needing to be installed first
As we can clearly see Virus Total does not in fact say it's a Trojan, because that's not a call Virus Total can in any way shape or form make.
What Virus Total can do is look at what AV's are saying and forward the information to you, like that the most popular sum label that AV's give the file is: trojan
Again, Virus Total is not saying it is a Trojan, someone else is and it's mearly delivering their message...so don't shoot the messanger.
Speaking of that someone else...or I should say those others:
Only 3 out of 64 av's detect anything at all:
Jiangmin - Reputable Chinese vendor, all the Chinese websites say so, so it must be true.
Detection: Trojan.Multi.mgi
- Trojan - Something dangerous hidden in something not dangerous, common for viruses.
- Multi - We can only guess since the vendor provides 0 explanation about this flag, could mean it can target "multiple" types of operating systems (remember this for later)
- mgi - Again we can only guess since the vendor provides 0 explanation about this flag, could mean "multiple generic infections", or "machine, general, infection" (as in guessed/suspected by some machine learning algorithm from the AV)
NANO-Antivirus - Reputable vendor according to Microsoft, ignore that it's located in the Russian Federation, because if Microsoft says it then it must be true.
Detection: Trojan.Win32.Remcos.ksibzy
- Trojan - Something dangerous hidden in something not dangerous, common for viruses.
- Win32 - Targets specifically Windows operating systems
- Remcos - Remote control and surveillance, can collect information like keystrokes or perform keystroke operations to manipulate files for instance (keep this in mind for later as well)
- ksibzy - We can only guess since the vendor provides 0 explanation about this flag, possibly "key, stroke, who the fuck knows"
DrWeb - Oh mother Russia...*vodka induced hiccup*...have you ever heard the tragedy of DrWeb aka Darth Webodka the wise, it is said he had the power to protect other people's PC's from viruses, but not his own, in the end his own Ukrainian apprentice killed him with a virus in his sleep....and ran off with 10TB of data, circa 2024...allegedly.
Detection: JS.Proslikefan.1
- JS - Targets any system trough any program (usually browser) that has Java Script enabled
- Proslikefan.1 - Worm that can copy itself (last thing you need to keep in mind for later, I promise), no I do not have any idea why the fuck it's called Proslikefan or why it's number 1, other then that AV companies love to give cryptic names to shit to make it sound scarry to the uneducated and impossible to decipher by anyone outside their snake oil salesman club.
So let's recap, 1 Vendor "made in China", 1 "token" Russian Vendor so Microsoft doesn't get labeled as russo-racist and 1 Vendor that may or may not be a slavic sith lord...sounds about right.
The important parts gleaned from their AV's reports: multiple types of operating systems are targeted, it can record keystrokes and it can copy itself.
In other words all the standard things you'd expect from a video game made in RPGMaker MV, case closed.
Okay fine, the more thourough explanation:
- Multiple types of operating systems are targeted:
RPGMaker MV is scripted with Java Script and packaged with an interperter to run on Windows locally, but can also be ran from a browser on any system by just uploading the contents of the "www" folder to a webiste (like NewGrounds for example)
- It can record keystrokes:
A game has to record keystrokes for you to play it and alt tabbing messing up volume controls is no fun, also it needs to remember what you typed for save states.
- It can copy itself:
Save states are nice, but being able to store them or some info from them is even better...oh hello mister Save File would you like to be able to have your future children and grandchildren live on my hard drive, of course you would, here take my car, my house and my wife while you're at it as well!
Paranoia Andy:
RPGMaker MV should have a free trial, so if this game was made with the latest version you can check the core files against each other.
Additional plugins used for this game could mostly be found on RPGMaker forums and dedicated websites.
The scripts can simply be opened and inspected in any text editor (notepad goes brrrrr).
Now Paranoia Andy you need to realise everything is fine, but...
Never trust anything, put everything in a sandbox inside of Windows inside of a virtual machine inside of a linux system inside a bare metal virtual machine...don't even trust your self, because your self knows all of your secrets and you your self might be a snitch!
Conclusion:
I diagnose the patient with terminal Java Script...and may God have mercy on their soul.
You must be registered to see the links
:
When in doubt if an AV is hallucinating, always remember the golden rule: "If it discriminates against innocent black men, it discriminates against innocent computer programs", for further details please consult the additional
safety guide for newbies and innocent black men online.