home

mtkdroidtools_v248.exe

7-Zip

Igor Pavlov

The application mtkdroidtools_v248.exe has been detected as a potentially unwanted program by 23 anti-malware scanners. The program is a setup application that uses the 7z Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from fileshare1260.dfiles.eu and multiple other hosts.
Publisher:
Igor Pavlov

Product:
7-Zip

Description:
7z SFX

Version:
9.20

MD5:
bd42c7cf9dca79e70caf3ef1517f6815

SHA-1:
4928134a6365a5b898d6a3b9710f9c700f758362

SHA-256:
ff710416ed2eef80af68fb67958ed7a829e773eea32f8f6f619ea22c0d2d6939

Scanner detections:
23 / 68

Status:
Potentially unwanted

Analysis date:
5/2/2024 5:37:15 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Trojan.Heur.FuW@YsmSzpji
994

AegisLab AV Signature
ANDROID-GetRoot.Gen
2.1.4+

Avira AntiVirus
Android/GetRoot.A
7.11.148.228

avast!
ELF:Lotoor-AI [PUP]
2014.9-140517

Bkav FE
W32.Clod77b.Trojan
1.3.0.4959

Comodo Security
UnclassifiedMalware
18253

Dr.Web
Android.Exploit.5
9.0.1.0137

ESET NOD32
Android/Exploit.Lotoor.DH
8.9784

Fortinet FortiGate
Android/ZergRush.B!exploit
5/17/2014

F-Prot
AndroidOS/Lotoor.AH
v6.4.7.1.166

F-Secure
Gen:Trojan.Heur.FuW@YsmSzpji
11.2014-17-05_7

IKARUS anti.virus
Exploit.Linux.Lotoor
t3scan.1.6.1.0

K7 AntiVirus
Riskware
13.177.12041

McAfee
Artemis!BD42C7CF9DCA
5600.7128

Microsoft Security Essentials
HackTool:AndroidOS/ZergRush.B
1.10502

MicroWorld eScan
Gen:Trojan.Heur.FuW@YsmSzpji
15.0.0.411

NANO AntiVirus
Trojan.Win32.IframeExec.cuambo
0.28.0.59608

Norman
Suspicious_Gen5.ADEEK
11.20140517

Rising Antivirus
PE:Trojan.Win32.Generic.1588F8E8!361298152
23.00.65.14515

Sophos
Andr/DroidRt-M
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0RE114
7.2.137

Trend Micro
TROJ_GEN.R0CBC0RE114
10.465.17

VIPRE Antivirus
Trojan.Win32.Generic
29082

File size:
7.1 MB (7,492,128 bytes)

Product version:
9.20

Copyright:
Copyright (c) 1999-2010 Igor Pavlov

Original file name:
7z.sfx.exe

File type:
Executable application (Win32 EXE)

Installer:
7z Setup

Common path:
C:\users\{user}\downloads\mtkdroidtools_v248.exe

File PE Metadata
Compilation timestamp:
11/18/2010 8:27:33 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:6Gc/ktllfiwjYyaig5Q0smwYfc2r86Y+JoXOP:6GggLU1smwsc2r86YgoeP

Entry address:
0x1D262

Entry point:
55, 8B, EC, 6A, FF, 68, 20, 1E, 42, 00, 68, 5C, D2, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 04, 11, 42, 00, 59, 83, 0D, 90, BD, 42, 00, FF, 83, 0D, 94, BD, 42, 00, FF, FF, 15, 00, 11, 42, 00, 8B, 0D, 70, 9D, 42, 00, 89, 08, FF, 15, FC, 10, 42, 00, 8B, 0D, 6C, 9D, 42, 00, 89, 08, A1, 64, 11, 42, 00, 8B, 00, A3, 8C, BD, 42, 00, E8, 1C, 01, 00, 00, 39, 1D, 20, 7A, 42, 00, 75, 0C, 68, EA, D3, 41, 00, FF, 15, 0C, 11...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
124.5 KB (127,488 bytes)

The file mtkdroidtools_v248.exe has been seen being distributed by the following 12 URLs.

http://fileshare1260.dfiles.eu/auth-14772492482e4c2a8896448a930fb1df-83.52.27.59-19323595-145670995-guest/.../MtkDroidTools_v248.exe

http://fileshare1260.depositfiles.org/auth-14769178576b15b15a6dd33a154ac53b-187.189.190.9-16020846-145670995-guest/.../MtkDroidTools_v248.exe

http://fileshare1260.depositfiles.com/auth-1479279239b69addd7654e68ca5dc200-156.203.43.207-40057883-145670995-guest/.../MtkDroidTools_v248.exe

http://fileshare1260.dfiles.eu/auth-146800312119aec24f753afcfee8dc26-78.223.117.245-2615924183-145670995-guest/.../MtkDroidTools_v248.exe

http://fileshare1260.depositfiles.com/auth-1461425978cea97407b30b4dad4af05e-92.241.38.75-2541847359-145670995-guest/.../MtkDroidTools_v248.exe

http://www.naijamouthed.com/uploads/.../download

http://fileshare1260.depositfiles.com/auth-146609784042e0680dbe29b9fd62f9e4-106.187.96.166-2595514820-145670995-guest/.../MtkDroidTools_v248.exe

http://fileshare1260.depositfiles.com/auth-145995837507f58c9c7093fcf1dedccc-196.221.88.189-2524042707-145670995-guest/.../MtkDroidTools_v248.exe

http://www.mediafire.com/download/.../MtkDroidTools_v248.exe

http://ge.tt/api/1/files/8FOYWVj/.../blob?download

http://fileshare3470.dfiles.eu/auth-14061309075bdfafea5c993d5b10c364-86.198.205.251-1564683532-145670995-guest/.../MtkDroidTools_v248.exe

http://4pda.ru/.../index.php?act=attach&id=3429624&dlsess=8f8b1706ea65c6d059c4acbac4f52660

Remove mtkdroidtools_v248.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.