home

hotel.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from rghost.net.
MD5:
25648b8c3896db7d3d33d058c41308ca

SHA-1:
416ac9c5049dfe2ad60c5d380841f5a80a2fc70c

SHA-256:
87e1d15554984f4a865aa0fedcb73e92720bfa39fcc89b889f615ea48e48f229

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 11:46:05 AM UTC  (today)

File size:
552 KB (565,248 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\hotel.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
12288:8ATQh5tSRlMpQ5eHGO8wA0Z0Q+M5KaFleXEj3ej/8w/Obqgmyx8H+:8Ai8n5uBi0aZlM80yj0EObjaH+

Entry point:
C2, 3C, 64, C1, 98, 7D, 6C, B2, DA, 9F, 9B, 17, 50, 23, 33, 32, ED, 35, AC, 9B, 6A, E1, AA, 54, 5B, 8B, 5B, 8E, A1, B1, 98, B4, 6B, 38, 42, A4, 21, 14, AC, 29, 27, 3B, EB, 2C, EF, F8, AB, 6D, E4, E0, B2, 08, 3C, D4, 85, 5C, 96, CF, 61, BE, DB, 48, 74, 7B, 31, B6, 69, 5E, B8, 5A, 0B, 89, 6E, 4E, 9C, AC, BE, 69, CE, FD, BF, E4, 2A, 81, 14, A7, 20, C4, E7, F7, 14, 4E, DC, 9C, B4, BA, 20, 04, B8, 5B, 95, 20, 52, 3F, 04, 55, 16, 4D, FD, E3, 8A, 9B, E5, 0A, 63, BA, 5B, 6B, C1, 2B, 21, 02, 79, CE, 6A, D3, 7A, 31...
 
[+]

Entropy:
7.9997  (probably packed)

The file hotel.exe has been seen being distributed by the following URL.

http://rghost.net/download/53091497/.../HOTEL.exe

Scan hotel.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.