home

21313106.exe

ThreatTrack Security, Inc.

The executable 21313106.exe has been detected as malware by 9 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Enldtion’.
Publisher:
ZALAN  (signed by ThreatTrack Security, Inc.)

Product:
ZALAN

Version:
0.00.0001

MD5:
87b9a130abc68e7d6e181d1c18cfa87f

SHA-1:
2ad38212a009d5c9ee044cfd96abf2676113df34

SHA-256:
f5f95d5b2c64b83f7a92bc494d12339cfbbeac5ef0c31271ec39ce28ce823aae

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
4/23/2024 6:42:52 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
160209-2

Dr.Web
Trojan.Siggen6.38594
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Symmi.56491
10.0.0.5366

ESET NOD32
Win32/Boaxxe.BR trojan
7.0.302.0

F-Secure
Variant.Symmi.56491
5.15.21

Kaspersky
Trojan.Win32.Boaxxe
15.0.0.562

Microsoft Security Essentials
Threat.Undefined
1.213.6144.0

Norman
Gen:Variant.Symmi.56491
03.02.2016 10:30:35

Sophos
Virus 'Troj/Miuref-AI'
5.23

File size:
147.9 KB (151,440 bytes)

Product version:
0.00.0001

Original file name:
ZALAN.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\enldtion\21313106.exe

Digital Signature
Signed by:
ThreatTrack Security, Inc.

Authority:
DigiCert Inc

Valid from:
5/14/2013 4:00:00 AM

Valid to:
7/22/2015 4:00:00 PM

Subject:
CN="ThreatTrack Security, Inc.", O="ThreatTrack Security, Inc.", L=Clearwater, S=Florida, C=US

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
09D4BCAF771ADF6588CF63A3A3A12C31

File PE Metadata
Compilation timestamp:
4/4/2015 5:51:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:XobNlbIt0km3tYNhT4fzEpCzcvOlm3BKVezoQWTLg2IT1+d4+wVuO:Oy0kPHFCzcGlm3sVekaVPf

Entry address:
0x12FC

Entry point:
68, 64, 30, 41, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, FD, AC, FE, BB, AC, B0, 96, 49, 8D, DD, 10, 6A, 20, DA, 86, BC, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 59, 02, 83, 00, 00, 00, 50, 68, 61, 72, 6D, 61, 6B, 6F, 6E, 7A, 65, 72, 6E, 30, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 0E, 63, 9D, F2, D4, 4A, B4, B6, 4E, 88, D1, A0, C8, BD, EE, 87, 03, B2, C9, 2F, 4A, 8A, EC, 8D, 4D, A9, AF, B9, B7, C1, 11, 8C, F7, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
124 KB (126,976 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Enldtion

Command:
C:\users\{user}\appdata\local\enldtion\21313106.exe


Remove 21313106.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.