AMD/ATI Pixel Clock Patcher

[ToastyX]

(11-10-2019 01:49 PM)board-temp Wrote:  Hello, registered this account to post here because after installing atikmdag-patcher.exe on my system i was infected with a trojan.

it creates a task scheduler job that triggers a javascript file on user logon, which transfers data from and to pastebin periodically, and also tries to run a C2 channel to a russian IP 178.140.134.36 on port 4322. my palo alto firewall detected and blocked it as "RevengeRat Command and Control Traffic".

i sent the atikmdag-patcher.exe to joes sandbox and got everything confirmed:
http://joesandbox.com/analysis/188753/0/html
so if you don't believe me, this analysis report should change your mind.


if the file was infected on my system by some other means then sorry, but i thought i better warn users here of the potential infection.
(edit: i redownloaded the file from page 1 of this thread on 2019-11-10 14:45 GMT and it still detects as malicious)
(edi2: i downloaded the exe fresh from sourceforge on 2019-11-10 15_25 and it also detects as malicious. will report there too)

The file you uploaded to Joe Sandbox is not the same file linked in the first post. The file on SourceForge is not my file. Do not download this program from other sites.

The atikmdag-patcher.exe file is supposed to be 95744 bytes (MD5: d61992cbdda1a789a9d5f597fd0de125). The file you linked to is 6 MB. I verified that the file in the first post is still the correct file and is not infected.