home

setup.exe

RATOC REX-PEU3/EXU3 USB 3.0 Host Controller Driver

RATOC Systems, Inc.

The executable setup.exe, “Setup launcher ” has been detected as malware by 10 anti-virus scanners. This is the uninstaller utility registered in the Windows Control Panel for the program RATOC REX-PEU3/EXU3 USB 3.0 Host Controller Driver by RATOC Systems, Inc.. The file is most likely infected with the Neshta virus, a Russian virus that gathers system information and send it to a remote command and cotrol server.
Publisher:
RATOC Systems, Inc.   (signed by RATOC Systems, Inc.)

Product:
RATOC REX-PEU3/EXU3 USB 3.0 Host Controller Driver

Description:
Setup launcher

Version:
1.0.18.0

MD5:
381c8180fa5dcbabb83906412aeb4af9

SHA-1:
7164e9ca55f3e38c04b4dca484a72338746c589c

SHA-256:
74a51a7b43a435b22a46f8231ef09fdd38331f2f9d1cd0715b4897bf975e7f61

Scanner detections:
10 / 68

Status:
Malware

Explanation:
Infected with the direct-infection Neshta file infector virus.

Analysis date:
4/25/2024 12:42:49 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win32/Neshta
2015.06.05

AVG
Worm/Delf
2016.0.3033

Baidu Antivirus
Virus.Win32.Neshta.$a
4.0.3.15730

Fortinet FortiGate
W32/Neshta.A
7/30/2015

G Data
Win32.Neshta
15.7.25

IKARUS anti.virus
Virus.Win32.Neshta
t3scan.1.9.5.0

Microsoft Security Essentials
Virus:Win32/Neshta.A
1.1.11701.0

Panda Antivirus
W32/Neshta.A
15.07.30.08

Rising Antivirus
PE:Win32.Netsha.a!411233
23.00.65.15728

Vba32 AntiVirus
Virus.Win32.Neshta.a
3.12.26.4

File size:
970 KB (993,256 bytes)

Product version:
1.0.18.0

Copyright:
Copyright (C) 2009 RATOC Systems, Inc.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\installshield installation information\{0231d55f-1179-401a-aeee-9cfcaddd72b4}\setup.exe

Digital Signature
Signed by:
RATOC Systems, Inc.

Authority:
VeriSign, Inc.

Valid from:
10/13/2009 9:00:00 AM

Valid to:
10/14/2010 8:59:59 AM

Subject:
CN="RATOC Systems, Inc.", OU=Development Division, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="RATOC Systems, Inc.", L=Naniwa-ku Osaka City, S=Osaka, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
10B8BDE9AF2C56328AB4F118391541A5

File PE Metadata
Compilation timestamp:
9/22/2009 1:58:50 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:5gPE9E45lYqV6d+4oscKQg2tTLe4eQW25I:GL4cqodaKBYT69ZqI

Entry address:
0x6984B

Entry point:
55, 8B, EC, 6A, FF, 68, 80, CF, 48, 00, 68, 58, A4, 46, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, 7C, B1, 48, 00, 33, D2, 8A, D4, 89, 15, 70, C1, 4A, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 6C, C1, 4A, 00, C1, E1, 08, 03, CA, 89, 0D, 68, C1, 4A, 00, C1, E8, 10, A3, 64, C1, 4A, 00, 6A, 01, E8, F1, 3F, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C3, 00, 00, 00, 59, E8, D1, 19, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B2, 00, 00, 00, 59, 33, F6, 89, 75...
 
[+]

Entropy:
6.6988

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
550 KB (563,200 bytes)

Program Uninstaller
Program name:
RATOC REX-PEU3/EXU3 USB 3.0 Host Controller Driver

Display publisher:
RATOC Systems, Inc.

Display version:
1.0.18.0

Uninstall string:
"C:\Program Files (x86)\InstallShield Installation Information\{0231D55F-1179-401A-AEEE-9CFCADDD72B4}\setup.exe" -runfromtemp -l0x0411 -removeonly


Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.