Hi there! I'm new to this forum, and in spite of these recent transgressions, I'm still pretty excited to be here! But I do have some possibly bad news: I just checked the other programs on Alcatel's github to see if they had any other viruses, and some seem to be loaded with them. Now, I'm not as tech savvy as many of you, so I used the VirusTotal.com website's detection feature in a virtual machine to analyze the download files from all of the Arukateru github repositories that weren't forked, but I don't know how to tell the difference between the security threats that are dangerous, and the ones that have to be in the software to inject code properly (or if there's even a way to tell the difference). Despite my semi-ignorance, what I've found is the following:
Below are the Programs analyzed that were detected as dangerous, then the Analyzers that detected them as dangerous, and in (parenthesis, the reason or specific virus it was detected as). Below each List of analyzers detecting the file as dangerous is the overall statement written on the top of the website, as a summary of the analysis all of the analyzers found.
All [brackets] next to the analyzer names were changed into [brackets] because they used to be (parentheses) that were part of the names of the analyzers, and I didn't want that to get too confusing.
their UWPUnarmer-main.zip was detected as by
MaxSecure (Trojan.Malware.300983.susgen), but not by nobody else.
The official statement on the top of the website for this file analysis was
1/68 security vendor and no sandboxes flagged this file as malicious.
their IncompatibilityErrorRestorer-main.zip file was labelled overall a Trojan, and labelled dangerous by Google's detection. It was specifically labelled a Trojan by
MaxSecure (Trojan.Malware.300983.susgen),
Varist (W64/Evilnum.A.gen!Eldorado),
and VBA32 (Trojan.Link.CmdRunner).
The official statement on the top of the website for this file analysis was
4/65 security vendors and no sandboxes flagged this file as malicious.
their WindowsThemeSwitcher-main.zip was detected to be dangerous by Google's detection and a Trojan by
ClamAV (Win.Trojan.Taskkill-2)
The official statement on the top of the website for this file analysis was
2/64 security vendors and no sandboxes flagged this file as malicious
their BasicThemer5-main.zip returned with it being detected by
DeepInstinct (MALICIOUS),
Elastic (Malicious (high Confidence)),
ESET-NOD32 (A Variant Of WinGo/Agent.OM),
Fortinet (Malicious_Behavior.SB),
Ikarus (Trojan.WinGo.Shellcoderunner),
McAfee (Artemis!240FDF3ABBB0),
McAfee-GW-Edition (BehavesLike.Generic.tc),
Sangfor Engine Zero (Trojan.Win32.Agent.Vl9s),
SentinelOne (Static ML),
and Static AI (Suspicious Archive)
The official statement on the top of the website for this file analysis was
9/65 security vendors and no sandboxes flagged this file as malicious.
their basicthemer2-detours-main.zip was detected overall as a trojan.lazy, with it being specifically detected by
ALYac (Gen:Variant.Lazy.256706),
Antiy-AVL (Trojan/Win32.SGeneric),
Arcabit (Trojan.Lazy.D3EAC2 [many]),
BitDefender (Gen:Variant.Lazy.256706),
DeepInstinct (MALICIOUS),
DrWeb (Trojan.Inject4.59781),
Emsisoft (Gen:Variant.Lazy.256706 (B)),
eScan (Gen:Variant.Lazy.256706),
Fortinet (PossibleThreat),
GData (Gen:Variant.Lazy.256706 (2x)),
Google (Detected), Lionic (Trojan.Win32.Generic.4!c),
Malwarebytes (Malware.AI.3388248531),
MAX (Malware (ai Score=86)),
MaxSecure (Trojan.Malware.191013703.susgen),
McAfee (Artemis!C43BAEB68E9B),
Panda (Trj/Chgt.AD),
Rising (Trojan.Generic@AI.83 (RDML:stPzYMVT4AqusOB2pr1Oiw)),
Skyhigh [SWG] (Artemis!Trojan),
Sophos (Mal/Generic-R),
Trellix [FireEye] (Gen:Variant.Lazy.256706),
TrendMicro-HouseCall (TROJ_GEN.R002H09DD24),
and finally, VIPRE (Gen:Variant.Lazy.256706).
The official statement on the top of the website for this file analysis was
23/66 security vendors and no sandboxes flagged this file as malicious.
Inside their basicthemer2-detours-main.zip:
In spite of a second analysis bringing this next program down to 18 virus analyzers detecting something dangerous, their BasicThemer2.exe originally had the highest amount of detection results back out of all of the files. It was detected overall as a trojan.lazy, with it being specifically detected by
ALYac (Gen:Variant.Lazy.256706),
Antiy-AVL (Trojan/Win32.SGeneric),
Arcabit (Trojan.Lazy.D3EAC2),
BitDefender (Gen:Variant.Lazy.256706),
Bkav Pro (W32.AIDetectMalware.CS),
CrowdStrike Falcon (Win/malicious_confidence_70% (W)),
Cylance (Unsafe),
DeepInstinct (MALICIOUS),
DrWeb (Trojan.Inject4.59781),
Emsisoft (Gen:Variant.Lazy.256706 (B)),
eScan (Gen:Variant.Lazy.256706),
Fortinet (PossibleThreat),
GData (Gen:Variant.Lazy.256706),
Google (Detected),
Malwarebytes (Generic.Malware/Suspicious),
MAX (Malware (ai Score=83)),
MaxSecure (Trojan.Malware.191013703.susgen),
McAfee (Artemis!C43BAEB68E9B),
Sangfor Engine Zero (Trojan.Win32.Lazy.Vbht),
Skyhigh [SWG] (Artemis!Trojan),
Sophos (Mal/Generic-R),
Symantec (Trojan.Gen.MBT),
Trellix [FireEye] (Generic.mg.c43baeb68e9bedcc),
TrendMicro-HouseCall (TROJ_GEN.R002H09DD24),
and finally, VIPRE (Gen:Variant.Lazy.256706)
The official statement on the top of the website for this file analysis was
25/70 security vendors and no sandboxes flagged this file as malicious.
Lastly, despite reanalyzing this next one on a whim and finding no issues, the original analysis of their BasicThemer3-main.zip was detected by
Kingsoft (Malware.kb.a.887).
The official statement on the top of the website for this file analysis was
1/68 security vendor and no sandboxes flagged this file as malicious.
Just to give some perspective, the original BasicThemer2-v0.5.2-Release-Final.zip that you download directly from the Github page had no issues whatsoever, and the basicthemer2.exe, in spite of being detected overall as a trojan, only had 7 detections in comparison to the 25 from Alcatel's version. The detections were from
Antiy-AVL (Trojan/Win32.Agent),
Bkav Pro (W32.AIDetectMalware.CS),
Cybereason (Malicious.b1e55f),
Google (Detected),
Gridinsoft [no cloud] (Trojan.Win32.Gen.cl),
Ikarus (Trojan.IL.MSILZilla),
and MaxSecure (Trojan.Malware.230446476.susgen)
The official statement on the top of the website for this file analysis was
7/72 security vendors and no sandboxes flagged this file as malicious.
And to top it off, I downloaded the official, most recent build of DWMBlurGlass from
github.com/Ingan121/BasicThemer2/releases/tag/v0.5.2-Final and put it through the same VirusTotal analysis website, and it came out with only one detection,
Jiangmin (HackTool.Inject.csr)
The official statement on the top of the website for this file analysis was
1/67 security vendor and no sandboxes flagged this file as malicious.
Hopefully I'm just being paranoid and the majority of the analyzed holes in these programs' and zip files' security end up being false positives or are purposeful due to what these programs and themes need access to in the system to run normally, but if someone with more tech know-how could check the analysis above just to be safe, that would be great.
Anyway, I look forward to chatting with all of you on better terms in the future, and I'm excited to be part of this community. Thanks and all the best.
PS:
Also, as a side note, does anyone have the link to where the actual windows 7 theme Alcatel stole, pane7, will be released when it is eventually finished? Or at very least who's making it, so I can save their github/website/deviantart page? I'm super excited to see and support the final product when it's ready!
