home

freekeyloggersetup.exe

FreeKeylogger

Valery Kuzniatsou

The application freekeyloggersetup.exe, “FreeKeylogger setup program” by Valery Kuzniatsou has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Valery Kuzniatsou  (signed and verified)

Product:
FreeKeylogger

Description:
FreeKeylogger setup program

Version:
2.0.0.0

MD5:
4c8e8dc7d8d5bfd6ddedaab6e101894b

SHA-1:
2fdf6e1bce18cd8fed86619da2b959e7561f223d

SHA-256:
30b0e01225e640efeda9218d54a07596fef6954cad5c71f396e4dcff43b82008

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/5/2024 4:53:51 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Installer.ValeryKuzniatsou.S
14.9.10.15

File size:
5.4 MB (5,620,536 bytes)

Copyright:
Copyright (c) 2012, Valery Kuzniatsou.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\freekeyloggersetup.exe

Digital Signature
Signed by:
Valery Kuzniatsou

Authority:
COMODO CA Limited

Valid from:
5/8/2013 2:00:00 AM

Valid to:
5/9/2014 1:59:59 AM

Subject:
CN=Valery Kuzniatsou, O=Valery Kuzniatsou, STREET=Slobodskaia st. 167-101, L=Minsk, S=Minsk, PostalCode=220025, C=BY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A601E2C6237BBF4FBBC63FF2151AF4B9

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:tHLT+kST9w/yJVLAZtMJip1dZPZYzaBlHF6nW26MrA3586XI4YHjjYtCKDWu/pSl:tnfY2nXxdZPuzaBdF6nW9Xi5gtv6gj5a

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file freekeyloggersetup.exe has been seen being distributed by the following 6 URLs.

http://gsf-cf.softonic.com/2fd/f6e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69674305&instance=softonic_en&type=PROGRAM&Expires=1446234841&Signature=dbmO~gx78srgHzg9PlvgLOJAviZAQc4ouLERjxyRZ2bmAlUkojvEKVplVeAw5H14qbmzMyY2~7gIT8hVFT6JTw3K3iDcQsdfQikujbKqdYt1GhIMa8aUb3XDK3vWatGatRUsGz5BjEDvwAYFV8Ss56~x04e6ZOEGQ5B3JDtaTgc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FreeKeyloggerSetup.exe

http://gsf-cf.softonic.com/2fd/f6e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69674305&instance=softonic_en&type=PROGRAM&Expires=1449260811&Signature=AsicNpKjrfNuGL-Phrt5cYWLBRz8VWPFsadLJEJGEftIqeVbWyjJAhktCrkD6kL9L8kjdpEoYtROu~l~qsTylbOEknqUE8uI--dHkIegeEUJkRvtZSo1mNRN2Xo-vri6ZLKYgnQH6KEVjZeFj4ppMPl9BejP8lI8EE0xfBsxuhw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FreeKeyloggerSetup.exe

http://gsf-cf.softonic.com/2fd/f6e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69674305&instance=softonic_en&type=PROGRAM&Expires=1451365993&Signature=dLYT6bLk48PlGqMLRXtCv2eV7POYz6xCaWoASrWXdete3LGC1CslTEz8L4YIkZSBMHgmh38jN2-sic4BeqZpwzaN67myii3Qh6ee1CeVMYfnEvWCEsHyMgmpTYsEk2C1865wl6o5IMHxk5oQJ2zsaO-wqFmABJOAMwW3IHJ~KYM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FreeKeyloggerSetup.exe

http://gsf-cf.softonic.com/2fd/f6e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69674305&instance=softonic_en&type=PROGRAM&Expires=1447161270&Signature=ZEmXRkV9yuem7FDWV~fzbTfuc-sfUtNZO4AaPC~Lcym-9hH39hxsMZxgo~ZQJp71LIHQ1bTic3VUjUKpQQHSZWqdBQv7g5r8ypBiWnleMM02mGBepWT6y3I7yzQpD~SW7D5M3mc7bDxtwANGZWcZb6EA1Gd2g2zrMQ8OhK-6mxg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FreeKeyloggerSetup.exe

http://gsf-cf.softonic.com/2fd/f6e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69674305&instance=softonic_en&type=PROGRAM&Expires=1447521806&Signature=ISb763xYVHXgnhAkKiUHjQEHYJVfzoGIGw85ivqfE0xzkuhNH~Aie6FqxwiOSRSfyhYkZFPozpZBFdFygScxMft2sImD3oSXQbARVpvPKYdvi0dBe0jtqzzK9UCBzUeNb8gLjVgS8OlcV2IkbDel1o6tmI56FOIR8736h1TpWnk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FreeKeyloggerSetup.exe

http://software-files-a.cnet.com/s/software/13/33/50/.../FreeKeyloggerSetup.exe

Remove freekeyloggersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.