home

mover rato v3 th.exe

The executable mover rato v3 th.exe has been detected as malware by 38 anti-virus scanners. This is a setup program which is used to install the application. According to the AV engines that detect this, it is a detection for a file infected by members of the Win32/Ramnit malware family and may drop and load other malware. The file has been seen being downloaded from fs10n1.sendspace.com and multiple other hosts.
MD5:
f6a55fb1cb2c71c58bfae063bc6601b2

SHA-1:
66ceaaac0fb515cf942f3693236a4574007fadd4

SHA-256:
d6dd1966b483a32d0d7256c2cbba699ee777506e51911ab1e2d48c009bb9365c

Scanner detections:
38 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
5/4/2024 1:28:27 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Ramnit
386

Agnitum Outpost
Win32.Ramnit.Gen.3
7.1.1

AhnLab V3 Security
Win32/Ramnit.B
2016.01.06

Avira AntiVirus
W32/Ramnit.A
8.3.2.4

Arcabit
Win32.Ramnit
1.0.0.642

avast!
Win32:RmnDrp
2014.9-160114

AVG
Win32/Ramnit.A
2017.0.2864

Baidu Antivirus
Virus.Win32.Nimnul.$a
4.0.3.16114

Bitdefender
Win32.Ramnit
1.0.20.70

Bkav FE
W32.HfsAutoB
1.3.0.7400

Clam AntiVirus
W32.Ramnit-1
0.98/21511

Comodo Security
Virus.Win32.Ramnit.A
23918

Emsisoft Anti-Malware
Win32.Ramnit
8.16.01.14.06

ESET NOD32
Win32/Ramnit
10.12822

Fortinet FortiGate
W32/Ramnit.C
1/14/2016

F-Prot
W32/Ramnit.B
v6.4.7.1.166

F-Secure
Win32.Ramnit
11.2016-14-01_5

G Data
Win32.Ramnit
16.1.25

IKARUS anti.virus
Virus.Win32.Ramnit
t3scan.1.9.5.0

K7 AntiVirus
Virus
13.212.18331

Kaspersky
Virus.Win32.Nimnul
14.0.0.816

Malwarebytes
HackTool.CheatEngine
v2016.01.14.06

McAfee
W32/Ramnit.a
5600.6520

Microsoft Security Essentials
Virus:Win32/Ramnit.A
1.1.12400.0

MicroWorld eScan
Win32.Ramnit
17.0.0.42

NANO AntiVirus
Virus.Win32.Nimnul.bpchjo
1.0.14.5380

nProtect
Win32.Ramnit
16.01.05.01

Panda Antivirus
W32/Cosmu.gen
16.01.14.06

Qihoo 360 Security
Virus.Win32.Ramnit.B
1.0.0.1077

Quick Heal
W32.Ramnit.A
1.16.14.00

Rising Antivirus
PE:Virus.Ramnit!1.9AA5 [F]
23.00.65.16112

Sophos
W32/Patched-I
4.98

Trend Micro House Call
PE_RAMNIT.H
7.2.14

Trend Micro
PE_RAMNIT.H
10.465.14

Vba32 AntiVirus
Virus.Win32.Nimnul.a
3.12.26.4

VIPRE Antivirus
Virus.Win32.Ramnit.a
46288

ViRobot
Win32.Ramnit.E[h]
2014.3.20.0

Zillya! Antivirus
Virus.Nimnul.Win32.1
2.0.0.2593

File size:
3.9 MB (4,135,424 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\mover rato v3 th.exe

File PE Metadata
Compilation timestamp:
6/28/2013 11:45:44 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:oYggd4anv+30JEBALEtyeype3fqohAogsLDagJI7hk49ec:o1dav+EJE6LYybo3GgJI7nec

Entry address:
0x3E8000

Entry point:
60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, 32, 6F, 01, 20, 2B, 85, 50, 72, 01, 20, 89, 85, 4C, 72, 01, 20, B0, 00, 86, 85, 9E, 74, 01, 20, 3C, 01, 0F, 85, DE, 02, 00, 00, 8B, 85, 4C, 72, 01, 20, 2B, 85, 58, 72, 01, 20, 8B, 00, 89, 85, EA, 73, 01, 20, 8B, 85, 4C, 72, 01, 20, 2B, 85, 5C, 72, 01, 20, 8B, 00, 89, 85, F2, 73, 01, 20, 83, BD, F2, 73, 01, 20, 00, 0F, 84, A9, 02, 00, 00, 83, BD, EA, 73, 01, 20, 00, 0F, 84, 9C, 02, 00, 00, 8D, 85, 8D, 74, 01, 20, 50, FF, 95, EA, 73, 01, 20, 83, F8, 00, 0F, 84, 86...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
35.5 KB (36,352 bytes)

The file mover rato v3 th.exe has been seen being distributed by the following 3 URLs.

https://fs10n1.sendspace.com/dl/af8badf5e05241f3e42a12e1dc648ca4/57f505b07804f8b3/.../Mover Rato V3 TH.EXE

https://fs10n3.sendspace.com/dl/4e4917b9fe6d31c8f33ccd46d84ff28c/57720e1476546748/.../Mover Rato V3 TH.EXE

https://fs10n5.sendspace.com/dl/0ed43798c0013effe4d611f141935029/56ff1089758c2aeb/.../Mover Rato V3 TH.EXE

Remove mover rato v3 th.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.