home

musallat.exe

z 3 r 0 _ x

The executable musallat.exe has been detected as malware by 33 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘MusaLLaT’.
Product:
z 3 r 0 _ x

Version:
8.01.0008

MD5:
07e7655ba30b81575852df1488a08b58

SHA-1:
a7dda864a22419f96d036806a1f4d1445f3af731

SHA-256:
5ed3a511c4b53ea08a1dafc75d7010789b84ec40254b6915062b4d9363194861

Scanner detections:
33 / 68

Status:
Malware

Analysis date:
5/2/2024 4:30:28 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Worm.VB
7.1.1

AhnLab V3 Security
Trojan/Win32.Xema
2013.10.26

Avira AntiVirus
TR/Dropper.Gen
7.11.109.104

avast!
Win32:Malware-gen
2014.9-170315

AVG
Luhe.Fiha.A.dropper
2018.0.2438

Baidu Antivirus
Worm.Win32.VB
4.0.3.17315

Comodo Security
TrojWare.Win32.Agent.~JH1
17154

Dr.Web
Trojan.KillFiles.3451
9.0.1.074

Emsisoft Anti-Malware
Generic.Malware.DHQ.BC0DDDF5
8.17.03.15.08

ESET NOD32
Win32/AutoRun.VB.AAO
11.8964

Fortinet FortiGate
W32/Agent.FDR!tr
3/15/2017

F-Secure
Generic.Malware.DHQ.BC0DDDF5
11.2017-15-03_4

G Data
Generic.Malware.DHQ.BC0DDDF5
17.3.22

IKARUS anti.virus
Email-Worm.Win32.VB
t3scan.2.0.127

K7 AntiVirus
Trojan
13.173.9980

Kaspersky
Worm.Win32.VB
14.0.0.-1314

Malwarebytes
Worm.Autorun
v2017.03.15.08

McAfee
W32/YahLover.worm.gen
5600.6094

Microsoft Security Essentials
Trojan:Win32/Rimod
1.163.1557.3

MicroWorld eScan
Generic.Malware.DHQ.BC0DDDF5
18.0.0.222

NANO AntiVirus
Trojan.Win32.VB.bcfhpl
0.26.0.55532

Norman
Obfuscated.H5!genr
11.20170315

nProtect
Worm/W32.Agent.131584.I
13.10.25.03

Panda Antivirus
Trj/CI.A
17.03.15.08

Rising Antivirus
Worm.Win32.VobfusEx.e
23.00.65.17313

Sophos
Mal/Behav-043
4.94

SUPERAntiSpyware
Trojan.Agent/Gen-Malent
8533

Total Defense
Win32/FakeFLDR_i
37.0.10498

Trend Micro House Call
TROJ_GEN.R0CBOC0J813
7.2.74

Trend Micro
TROJ_GEN.R0CBOC0J813
10.465.15

Vba32 AntiVirus
Trojan.VBRA.02819
3.12.24.3

VIPRE Antivirus
Trojan.Win32.Generic
22706

ViRobot
Worm.Win32.A.VB.132608
2011.4.7.4223

File size:
128.5 KB (131,584 bytes)

Product version:
8.01.0008

Original file name:
Dosya Klasörü.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\roaming\musallat.exe

File PE Metadata
Compilation timestamp:
1/4/2011 3:49:16 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x76580

Entry point:
60, BE, 00, B0, 46, 00, 8D, BE, 00, 60, F9, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 7B, 47, 07, 00, 57, 83, C3, 04, 53, 68, 7A, B5, 00, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
52 KB (53,248 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
MusaLLaT

Command:
C:\users\{user}\appdata\roaming\musallat.exe


Remove musallat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.