cat-users AT lists.geant.org

Subject: The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

List archive

[[cat-users]] setEAPCred.exe detected as malware

From: "Baumann Niklaus (PSI)" <niklaus.baumann AT psi.ch>
To: "cat-users AT lists.geant.org" <cat-users AT lists.geant.org>
Subject: [[cat-users]] setEAPCred.exe detected as malware
Date: Mon, 12 Dec 2016 15:21:59 +0000
Accept-language: en-US, de-CH

Dear eduroam CAT users/admins,

Since this week some versions of setEAPCred.exe (0.14) are being detected as malware by McAfee (and other AV-products).

I found the same version 0.14 of the file with binary differences on the clients. The affected sample was stored in %userprofile%\appdata\local\temp\.

Scan results on virustotal:

setEAPcred.exe:

virustotal (2/56): https://www.virustotal.com/en/file/b73cb8c78cecc47d34d02d3249e356b68e0d49332ce8f97f279ad453cbd5fe96/analysis/1481554589/

SETEAPCRED.EXE
virustotal (5/56): https://www.virustotal.com/en/file/c5999f7b7510ba7c49255dbb0a9ef66d31de1245778b3937294eaee3ea478fdc/analysis/

From the analysis in a sandbox I think it is a false positive and we’re going to report it as such to McAfee.

Did someone else run into similar issues with AV scanners before with setEAPcred.exe?

Best regards,

Nik

[[cat-users]] setEAPCred.exe detected as malware, Baumann Niklaus (PSI), 12/12/2016
- Re: [[cat-users]] setEAPCred.exe detected as malware, Tomasz Wolniewicz, 12/23/2016
  - RE: [[cat-users]] setEAPCred.exe detected as malware, Baumann Niklaus (PSI), 12/23/2016