home

1eb117c45f0e6f6dd61ea6792a8e3b81.exe

akUkzqRtA2TSU

mkrautz.dk

The executable 1eb117c45f0e6f6dd61ea6792a8e3b81.exe has been detected as malware by 11 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘1eb117c45f0e6f6dd61ea6792a8e3b81’.
Publisher:
ak2XC3EJzSyH  (signed by mkrautz.dk)

Product:
akUkzqRtA2TSU

Description:
aaLQnqYmr06

Version:
6.7.9.39

MD5:
89c6e3e4ba502fa203554b8c8d40b1bb

SHA-1:
d225d06def7de94381aea7517bdffcd7ad5051e0

SHA-256:
a98000c3595c99b54847b846a2c188e35f454ced48ea4d5c8e6fb811251e2f9c

Scanner detections:
11 / 68

Status:
Malware

Analysis date:
5/28/2024 4:33:32 AM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.W32.Gen.lWHK
2.1.4+

Avira AntiVirus
TR/Dropper.MSIL.Gen
8.3.3.4

avast!
MSIL:GenMalicious-BVC [Trj]
2014.9-161216

AVG
Win32/Hedo
2017.0.2527

Baidu Antivirus
Win32.Trojan.WisdomEyes.16070401.9500
4.0.3.161216

ESET NOD32
MSIL/TrojanDownloader.Small.GI (variant)
10.14611

Fortinet FortiGate
MSIL/Injector.CMC!tr
12/16/2016

IKARUS anti.virus
Trojan-Dropper.Win32.FrauDrop
0.1.3.4

K7 AntiVirus
Trojan
13.246.21802

McAfee
Artemis!89C6E3E4BA50
5600.6183

Qihoo 360 Security
HEUR/QVM03.0.0000.Malware.Gen
1.0.0.1120

File size:
215.3 KB (220,472 bytes)

Product version:
6.7.9.39

Copyright:
Copyright © 2006

Trademarks:
aXn7YILunFH4QV

Original file name:
1234.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\microsoft\windows\start menu\programs\startup\1eb117c45f0e6f6dd61ea6792a8e3b81.exe

Digital Signature
Signed by:
mkrautz.dk

Authority:
COMODO CA Limited

Valid from:
5/14/2015 1:00:00 AM

Valid to:
5/14/2016 12:59:59 AM

Subject:
CN=mkrautz.dk, O=mkrautz.dk, STREET=Kirkegade 6, L=Esbjerg, S=Region of Southern Denmark, PostalCode=6700, C=DK

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E67B5A22B512A249FB28895542C648F6

File PE Metadata
Compilation timestamp:
11/18/2016 4:28:31 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

Entry address:
0x32ECE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
196 KB (200,704 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
1eb117c45f0e6f6dd61ea6792a8e3b81

Command:
"C:\users\{user}\appdata\roaming\dns.exe"..


Remove 1eb117c45f0e6f6dd61ea6792a8e3b81.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.