4 ms·

VirusTotal said it is ok? https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7 https://www.virustotal.com/gui/f

• diggan 2y ago
  The only thing VirusTotal would tell you about, is already known patterns of virus/malware. If there is a novel/different way of doing something, and/or it hasn't been noticed by the AVs they're collaborating with, you'll end up with everything green. PoC Rust program that takes the contents of .npmrc and uploads it to a random IP (DONT RUN THIS! It'll steal your npm authentication token): https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e88265 https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e8... "No security vendors flagged this file as malicious" = https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd90594cbba85723851fadc0d393cca5caae671c8b https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd... But clearly, it is malicious :)
  • littlestymaar 2y ago
    I don't understand, the op claims the alert came from Virustotal.
• forensicnoob 2y ago
  Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7/behavior https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9... at the bottom you can see the commands that looks like the program trying to delete down syslogs. Look also in the relations tab that shows some tor nodes.
  • blueflow 2y ago
    This is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process. I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.
  • viraptor 2y ago
    I don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?
  • Faaak 2y ago
    You mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself
    • FergusArgyll 2y ago
      Why would yt-dlp tell syslog to reload?
      • netsharc 2y ago
        It seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs. And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?". If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.
• 0x00cl 2y ago
  I think he might be talking about the "relations" tab. You can see the "Contacted IP addresses" section that claims to be "contacted IPs by the file uploaded to virus total". If you click the IP some will have detections and flagged as bad or criminal. https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c35e415f4a8fc69b626c60f12ca899bfc05f6a72fc/relations https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c3... Says it contacted 45.66.35.11 and you can see its a tor relay https://metrics.torproject.org/rs.html#details/7EA6EAD6FD83083C538F44038BBFA077587DD755 https://metrics.torproject.org/rs.html#details/7EA6EAD6FD830... Though haven't looked at how yt-dlp works, I'd guess yt-dlp might attempt to use tor network in case some IP or network is blocked and can't reach a server.
  • blueflow 2y ago
    Its not just a tor relay, it is one of the directory servers: https://metrics.torproject.org/rs.html#search/flag:authority https://metrics.torproject.org/rs.html#search/flag:authority