Executable get infected with Trojan:MSIL/Masslogger.VN!MTB after uploading to Jira

[Lukas Kisza]

I uploaded unsigned executable (C# compiled with visual studio) to JIRA (tested with cloud and standalone)

Right after upload I downloaded and file was same.

However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB

I turned off Defender real time protection and did BYTE COMPARISON of files (size was same) and FOUND DIFFERENCES in start sequence.

Does anyone have any logical explanation?

[Nic Brough -Adaptavist- · Accepted solution]

I do not think we can offer anything logical that goes right down to the root cause, we are very short of infomation, and probably need a lot more from you

Your described behaviour says that your anti-virus is interfering.  There is nothing wrong with it doing that, it's protective.  But it sounds like something is inserting a virus into the file after you've downloaded it.  This is nothing Atlassian software can do, it's something else on your machines.

[Lukas Kisza]

I'm afraid this is not the case. I've tried this on multiple computers in multiple separated environments and accounts. I do not believe all of them will have same virus. If I upload same executable on any other http/s storage (for example to GitLab or Google Drive) and download back it is clean. We are running standalone JIRA (but as I mentioned same behavior occurs on cloud JIRA...).

To sum up all points to that it is changed by JIRA.... :|

Can you help me to identify where are attachments stored in JIRA so we can monitor if it is changed directly on storage/DB level?

More information about executable: 

C# Windows form application (.exe) compiled without signing via Visual Studio.

P.S: I'm ok for live session where I can present the behavior and give you access to cloud Jira so you can download by yourself.

[Nic Brough -Adaptavist-]

I'm sorry, but you exactly described a case where something is changing a file AFTER you've downloaded it from Jira.  Specifically:

"Right after upload I downloaded and file was same.

However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB"

If the file on your local machine is changing, it can not be the Server you downloaded it from.  There is something on your machine changing it. Not Jira.

Even if I assume that your original report is not accurate, and the infection is actually happening on the Jira server, before download, you still have the problem that Jira has no code in it that writes to attachments.  All it can do is copy an upload stream to the attachment directory, and serve up previews of attached files. 

However, if the file really is being changed on the server, all that means is that your server has something on it that is infecting the files.  Whatever that is though, it's not Jira.

You also say you are on Cloud - that rules out any looking at the attachments on the storage, but also, if a virus were present on the Cloud service and doing this, it would have been found and shut down a long time ago.  If you are on Cloud, then it's an absolute fact that whatever is doing this is on your machines, not Jira.

[Lukas Kisza]

Since you wrote this I'm not able to reproduce problem in cloud environment. So accepting this as solution