IPC-Color4K-T webplugin.exe is infected

[Tmos]

Ran some tests on the download webplugin.exe and it is definitely infected. I am getting hits from 4 different AV tools.

The download comes from the cameras themselves.
a href="/webplugin.exe" target="_download">Click here to download</a

Any thoughts?
This is the camera sold on amazon...

https://www.amazon.com/gp/product/B0BC1BD9SQ

 

[wittaj]

Already a thread talking about the downloads:

Malware in EmpireTech IPC-Color4K-T webplugin.exe

I recently bought this camera from Amazon, new condition and sold by "EmpireTech-Andy". I setup the camera in an isolated environment, and during setup the camera prompts you to download (from the cameras embedded firmware) the webplugin.exe file to enable viewing imaging in a browser. After...

ipcamtalk.com

 

[TonyR]

FWIW, already a thread:

Malware in EmpireTech IPC-Color4K-T webplugin.exe

I recently bought this camera from Amazon, new condition and sold by "EmpireTech-Andy". I setup the camera in an isolated environment, and during setup the camera prompts you to download (from the cameras embedded firmware) the webplugin.exe file to enable viewing imaging in a browser. After...

ipcamtalk.com

 

[TonyR]

The download comes from the cameras themselves.

Uh...yeah.

 

[EMPIRETECANDY]

@Tmos thanks for your reporiting back, do you have any screenshot for the virus infected or plugin delete ? The 4 different AV tools are for which software then we can check with the Lab.