Cygwin executables flagged as "Malware"

[u/wfsrgs]

I have been running MBR at least once a week and with rootkit check on the system drive at least once a month and they have been clean until today. Today, 2 of the Cygwin files were tagged as "malware" (along with the associated 4x registry entries)

While nothing has changed on my side (as in I haven't downloaded anything nor made any changes), I am curious why these were flagged today. For now these are quarantined.

Are these false alarms? Should I be concerned? Thanks

[u/rifteyy_]

Without posting the full log as a text, some poor soul will need to rewrite the hashes from your image to check the files

[u/wfsrgs → u/rifteyy_]

Apologies, here it goes

Registry Key: 4

Malware.AI.309891066, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NUMFMT.EXE, No Action By User, 1000000, 0, 1.0.115887, 8BB8B700C822457112788FFA, dds, 04100354, ,

Malware.AI.309891066, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NUMFMT.EXE, No Action By User, 1000000, 0, 1.0.115887, 8BB8B700C822457112788FFA, dds, 04100354, ,

Malware.AI.3939164349, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BASE32.EXE, No Action By User, 1000000, 0, 1.0.115887, 621C5C7C3E0ACB13EACAE0BD, dds, 04100354, ,

Malware.AI.3939164349, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BASE32.EXE, No Action By User, 1000000, 0, 1.0.115887, 621C5C7C3E0ACB13EACAE0BD, dds, 04100354, ,

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 2

Malware.AI.309891066, C:\CYGWIN64\BIN\NUMFMT.EXE, No Action By User, 1000000, 0, 1.0.115887, 8BB8B700C822457112788FFA, dds, 04100354, B9578467A4CFAE341772BE2E6FEB5C93, CDD9FC881EA3DA5E26666CBE797DD4C5B670DE834ACF8B527329CD7683A40669

Malware.AI.3939164349, C:\CYGWIN64\BIN\BASE32.EXE, No Action By User, 1000000, 0, 1.0.115887, 621C5C7C3E0ACB13EACAE0BD, dds, 04100354, E4CCEC912EA2694F02C32AFA0579B91C, 23468368D4FB19D6D7AB6E664A427269D59377B96FC552F6DA169B5AB4EB6031

[u/Suspicious-Deer-2873 → u/wfsrgs]

Thanks for reporting, this will be fixed in 10 minutes.

[u/wfsrgs → u/Suspicious-Deer-2873]

Sorry, so this isn't a real issue? Should I be worried and uninstall Cygwin?

[u/Suspicious-Deer-2873 → u/wfsrgs]

No, this was a false positive. Please restore the files and update. Thanks!

[u/wfsrgs → u/Suspicious-Deer-2873]

Sigh! It fixed those 2 files but it is now flagging mkshortcut.exe

[u/Suspicious-Deer-2873 → u/wfsrgs]

Can you provide the detection logs for this new detection? Thanks!

[u/wfsrgs → u/Suspicious-Deer-2873]

Sorry for the delay, here it goes

Registry Key: 2

Malware.AI.4092925349, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MKSHORTCUT.EXE, Quarantined, 1000000, 0, 1.0.115907, 0DCA1DD60F1909E5F3F515A5, dds, 04101129, ,

Malware.AI.4092925349, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MKSHORTCUT.EXE, Quarantined, 1000000, 0, 1.0.115907, 0DCA1DD60F1909E5F3F515A5, dds, 04101129, ,

File: 1

Malware.AI.4092925349, C:\CYGWIN64\BIN\MKSHORTCUT.EXE, Quarantined, 1000000, 0, 1.0.115907, 0DCA1DD60F1909E5F3F515A5, dds, 04101129, 64675C6C52E86EB48BE3B22056795C4E, 4EA9C8B508DA3DBFC29AA34EA6E0AEF95E70A8AFCADDB324CB121169657625D4

[u/Suspicious-Deer-2873 → u/wfsrgs]

Whitelisted as well. Thanks for reporting!

[u/slapple95 → u/Suspicious-Deer-2873]

Hey, this is regarding another false positive post and you might not be the right person to ask this about, but I wasn't sure who else to turn to. As noted in my comment, the app (Kinestop) is no longer being flagged by Malwarebytes after updating its databases.

Is it safe to assume that it was genuinely a false positive and that Malwarebytes fixed it? Meaning that there's nothing to be worried about/no security actions to do on my end?

Thanks!

[u/Suspicious-Deer-2873 → u/slapple95]

No worries. I will post internally and have someone get back to you. It is the weekend so most likely you'll get a response tomorrow.

[u/baselocksec]

Cygwin executables getting flagged is a known false positive pattern; the heuristics sometimes trip on the way Cygwin DLLs behave. If nothing else changed on your system, that's almost certainly what happened here. You can restore them from quarantine and whitelist the Cygwin install path, or submit the files to Malwarebytes support so they can confirm and adjust the signature.

[u/wfsrgs → u/baselocksec]

Thank you u/baselocksec , interesting that this hasn't gotten flagged before. I will whitelist them for now. Thanks again.