home

mustang.exe

Mustang Browser

RAFO TECHNOLOGY INC

The application mustang.exe by RAFO TECHNOLOGY INC has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Mustang Browser by RAFO TECHNOLOGY INC.
Publisher:
Rafotech  (signed by RAFO TECHNOLOGY INC)

Product:
Mustang Browser

Version:
44.0.2403.46

MD5:
3ef6812c589ebd47e88dd90621e72bd1

SHA-1:
712a21dbd52a3aa7117ec97e900486afdb951827

SHA-256:
ec5f5499776491c3b19e1fdd0826a329d1a1f436579184db14f3c75b5c62ca8a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 2:36:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.RafoTech (M)
16.11.15.13

File size:
598.6 KB (612,952 bytes)

Product version:
1.44.46.6

Copyright:
Copyright 2015 Rafotech. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\mustang browser\mustang\mustang.exe

Digital Signature
Signed by:
RAFO TECHNOLOGY INC

Authority:
GlobalSign nv-sa

Valid from:
3/18/2015 12:50:02 AM

Valid to:
3/18/2016 12:50:02 AM

Subject:
CN=RAFO TECHNOLOGY INC, O=RAFO TECHNOLOGY INC, L=Alhambra, S=California, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130B87F4F087E63E0D3D6DC5F093C0729

File PE Metadata
Compilation timestamp:
8/22/2015 5:29:31 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:bMBDbELbnWodCMgcs9gOJ99sPqEpGcjTOup3LMeFfR6lqthLMmxS76mx:bK8/drPqAvpQ6sloLJSpx

Entry address:
0x3DD84

Entry point:
E8, 84, 97, 00, 00, E9, 7F, FE, FF, FF, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, 55, 8B, EC, 83, EC, 14, 53, 56, 33, DB, 57, 8B, 7D, 08, 89, 5D, F8, 89, 5D, F4, 89, 5D, FC, 85, FF, 75, 18, E8, F4, 16, 00, 00, 6A, 16, 5E, 89, 30, E8, 04, D1, FF, FF, 8B, C6, 5F, 5E, 5B, 8B, E5, 5D, C3, 6A, 24, 68, FF, 00, 00, 00, 57, E8, 1C, FA, FF, FF...
 
[+]

Entropy:
6.2948

Code size:
346 KB (354,304 bytes)

The file mustang.exe has been discovered within the following program.

Mustang Browser  by RAFO TECHNOLOGY INC
About 7% of users remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-52-45-70-108.compute-1.amazonaws.com  (52.45.70.108:80)

TCP (HTTP SSL):
Connects to mc.yandex.ru  (87.250.251.119:443)

TCP (HTTP):
Connects to ec2-52-73-116-54.compute-1.amazonaws.com  (52.73.116.54:80)

TCP (HTTP):
Connects to ADSERVERT68ZGL6  (52.144.44.103:80)

TCP (HTTP SSL):
Connects to server-54-239-172-62.atl50.r.cloudfront.net  (54.239.172.62:443)

TCP (HTTP):
Connects to ec2-35-166-161-54.us-west-2.compute.amazonaws.com  (35.166.161.54:80)

TCP (HTTP):
Connects to 240.221.186.35.bc.googleusercontent.com  (35.186.221.240:80)

TCP (HTTP):
Connects to ec2-52-202-7-162.compute-1.amazonaws.com  (52.202.7.162:80)

TCP (HTTP SSL):
Connects to cdn-208-111-161-254.iad.llnw.net  (208.111.161.254:443)

TCP (HTTP SSL):
Connects to 57.247.178.107.bc.googleusercontent.com  (107.178.247.57:443)

TCP (HTTP SSL):
Connects to new-york-20.cdn77.com  (185.59.223.24:443)

TCP (HTTP):
Connects to ec2-23-23-118-29.compute-1.amazonaws.com  (23.23.118.29:80)

TCP (HTTP):
Connects to dsde438.fornex.org  (212.224.112.111:80)

TCP (HTTP SSL):
Connects to dsde227.fornex.org  (212.224.113.30:443)

TCP (HTTP):
Connects to a96-6-123-75.deploy.akamaitechnologies.com  (96.6.123.75:80)

Remove mustang.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.