home

iroot_1.8.5.15285_cid1005_7337ba1e.exe

深圳信壹网络有限公司

The application iroot_1.8.5.15285_cid1005_7337ba1e.exe by 深圳信壹网络有限公司 has been detected as a potentially unwanted program by 7 anti-malware scanners. This is a setup program which is used to install the application.
Publisher:
深圳信壹网络有限公司  (signed and verified)

Version:
1.8.5.15285

MD5:
f59d89a2dac8d156b5f14fcd25493cdd

SHA-1:
2283f395f546b208bb578e085b0230bded466323

SHA-256:
d870ac214c25fe2b1878424b11cd32792e3a93be2503bff8e89a4c5fc2223321

Scanner detections:
7 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 9:59:53 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Android.Hacktool.Mgyun.A
595

avast!
Android:Agent-GYN [PUP]
2014.9-150620

AVG
Android/Deng
2016.0.3073

ESET NOD32
Android/Spy.Agent.BN (variant)
9.11812

G Data
Archive.Application.Agent.UKHTXO
15.6.25

NANO AntiVirus
Trojan.Android.Coogos.dspuwx
0.30.24.2086

Rising Antivirus
PE:Trojan.Win32.FakeAV.bsj!1075358218
23.00.65.15618

File size:
17.8 MB (18,654,088 bytes)

Product version:
1.8.5.15285

Copyright:
© 2011-2015 Xinyi Inc. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\iroot_1.8.5.15285_cid1005_7337ba1e.exe

Digital Signature
Signed by:
深圳信壹网络有限公司

Authority:
WoSign CA Limited

Valid from:
10/8/2014 11:34:44 AM

Valid to:
10/8/2017 11:34:44 AM

Subject:
CN=深圳信壹网络有限公司, E=szxyym@mgyun.com, O=深圳信壹网络有限公司, L=深圳市, S=广东省, C=CN

Issuer:
CN=WoSign Class 3 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
69B39EA88C3DBAEBF09D91F5BA0D6E2B

File PE Metadata
Compilation timestamp:
7/9/2014 11:58:13 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:Efthun6KLAsNKLbStuqr/Hml/iDv9kPgVvuarkOeDu+OWmFmIb02JfJ:ethun6ShNQIjHml/ijuIVTrxoWn1J

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86...
 
[+]

Entropy:
7.9965

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file iroot_1.8.5.15285_cid1005_7337ba1e.exe has been seen being distributed by the following 20 URLs.

temp:iRoot_1.8.5.15285_www.revdl.com.exe

http://www83.zippyshare.com/d/BjckuXRX/.../VRoot_1.8.5.15285_Setup.exe

temp:VRoot_1.8.5.15285_Setup.exe

blob:3B1BEF4D-2B89-4BE0-A030-D02F911CEFCF

https://mega.nz/persistent/.../chwh2IYB

https://mega.nz/temporary/.../NgEDiDDT

http://www83.zippyshare.com/d/BjckuXRX/.../VRoot_1.8.5.15285_Setup.exe

q=http://products.mgyun.com/.../downjump?productcode=vRoot&channelcode=1005&redir_token=D7G32BLkna-S3WySWraKoZ84PsB8MTQ0MTQ2MTE4NkAxNDQxMzc0Nzg2

https://userscloud.com/3ktcmd7uqz2v

https://downloader.disk.yandex.ru/disk/522a5daae0495f16860519af2a0b10979b3f8e87b6d536265b008001a6c3b637/567eef3a/.../x-msdownload&fsize=18654088&hid=e5a0649fc31388dda91f1764befa0f33&media_type=executable&tknv=v2

https://mega.nz/temporary/.../K8dg1IwZ

http://www83.zippyshare.com/d/BjckuXRX/.../VRoot_1.8.5.15285_Setup.exe

http://www83.zippyshare.com/d/BjckuXRX/.../VRoot_1.8.5.15285_Setup.exe

http://www.iroot.com/.../iroot

https://onedrive.live.com/download.aspx?cid=C7B9D4BFBE2BF7FA&authKey=!APrktw634vifEPw&resid=C7B9D4BFBE2BF7FA!324

https://mega.nz/persistent/.../WRACjAjC

https://mega.nz/temporary/.../WRACjAjC

http://soft.mgyun.com/files/products/vRoot/1005/2015/.../iRoot_1.8.5.15285_cid1005_7337ba1e.exe

http://products.mgyun.com/.../downjump?productcode=vRoot&channelcode=1005

http://products.mgyun.com/.../downjump?id=3614

Remove iroot_1.8.5.15285_cid1005_7337ba1e.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.