home

recycled.exe

The executable recycled.exe has been detected as malware by 37 anti-virus scanners.
MD5:
9f958d9d0ce84626311d452b16000abb

SHA-1:
255c0a11210a6733ef18048859ee774f470a7be9

SHA-256:
364bdc1040ee2cf611302e5bd0fb688137096a785232cecdc5ced1adaeb37db6

Scanner detections:
37 / 68

Status:
Malware

Analysis date:
5/21/2024 11:44:51 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Backdoor.FlyAgent
7.1.1

AhnLab V3 Security
Win32/Flystudio.worm.Gen
2013.11.19

Avira AntiVirus
TR/Dropper.Gen
7.11.114.120

avast!
Win32:EvilEPL [Cryp]
2014.9-160619

AVG
SHeur2
2017.0.2708

Baidu Antivirus
Trojan.Win32.FlyStudio
4.0.3.16619

Bitdefender
GenPack:Backdoor.Generic.176115
1.0.20.855

Bkav FE
W32.FlyStudioTn
1.3.0.4562

Clam AntiVirus
Worm.FlyStudio-16
0.98/18155

Comodo Security
TrojWare.Win32.TrojanDropper.Flystud.~d01
17298

Dr.Web
Win32.HLLW.Autoruner.26035
9.0.1.0171

Emsisoft Anti-Malware
GenPack:Backdoor.Generic.176115
8.16.06.19.07

ESET NOD32
Win32/AutoRun.FlyStudio.KK
10.9066

Fortinet FortiGate
W32/PckdFlyStudio.gen
6/19/2016

F-Prot
W32/Nuj.A.gen
v6.4.7.1.166

F-Secure
Trojan-Dropper:W32/Peed.gen!A
11.2016-19-06_1

G Data
GenPack:Backdoor.Generic.176115
16.6.22

IKARUS anti.virus
Worm.Win32.FlyStudio
t3scan.2.2.29

K7 AntiVirus
Trojan
13.173.10234

Kaspersky
Trojan-Downloader.Win32.FlyStudio
14.0.0.34

McAfee
W32/Autorun.worm.ev
5600.6364

Microsoft Security Essentials
Backdoor:Win32/FlyAgent.F
1.163.1557.0

MicroWorld eScan
GenPack:Backdoor.Generic.176115
17.0.0.513

NANO AntiVirus
Trojan.Win32.FlyStudio.dknjr
0.28.0.56316

Norman
FlyAgent.CX
11.20160619

nProtect
Trojan-Dropper/W32.FlyStudio.1417826
13.11.19.01

Panda Antivirus
W32/FlySky.AD
16.06.19.07

Quick Heal
Backdoor.FlyAgent.F
6.16.12.00

Rising Antivirus
Worm.Win32.Agent.aaq
23.00.65.16617

Sophos
Mal/EncPk-NB
4.94

SUPERAntiSpyware
Trojan.Agent/Gen-Fly[Large]
9072

Total Defense
Win32/Nuj.GU
37.0.10498

Trend Micro House Call
WORM_AUTORUN.SMW
7.2.171

Trend Micro
WORM_AUTORUN.SMW
10.465.19

Vba32 AntiVirus
TrojanDownloader.FlyStudio
3.12.24.3

VIPRE Antivirus
Trojan.Win32.Autorun.dm
23516

ViRobot
Worm.Win32.FlyStudio.130232
2011.4.7.4223

File size:
1.4 MB (1,417,826 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
12/25/1972 9:03:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
4.0

CTPH (ssdeep):
24576:idHiUYtpC3DJSMN87DmKtiX27yaEwN3M31BPgDHKrbbvDh4qtsaOkRYHkoZ:idkC3DJSEC17dEAMyafDh4zrk2H9

Entry address:
0x1344

Entry point:
52, F8, 56, 57, 50, 53, 51, 0F, 83, 30, FE, FF, FF, 1F, 6B, 01, 2C, 56, 83, EB, 14, E9, 30, F9, F0, 85, 03, C5, FE, 48, 38, ED, 74, 59, E8, 73, 5C, 6F, 80, 64, A2, 93, 71, B8, 6C, 26, 29, 7A, A9, 25, 43, 29, ED, AC, FA, 5D, 7C, B9, E4, AD, A5, 33, DD, F9, 83, D0, 03, E9, 17, FE, FF, FF, DA, AE, 2B, 40, 04, DB, 61, 5E, 0F, 83, 5B, FE, FF, FF, E2, 22, 0A, 28, 3D, DD, D0, 83, EE, F8, E9, AE, FE, FF, FF, 6A, 19, 5B, 2F, 1B, CF, 3F, 0F, 85, AA, FD, FF, FF, 0F, 83, E5, FF, FF, FF, 90, A6, 5B, 7A, D6, 4B, 56, 5F...
 
[+]

Entropy:
7.9513  (probably packed)

Code size:
24 KB (24,576 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ec2-52-0-217-44.compute-1.amazonaws.com  (52.0.217.44:80)

Remove recycled.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.