home

SpyShelter.exe

SpyShelter

Datpol

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘SpyShelter’.
Publisher:
Datpol  (signed and verified)

Product:
SpyShelter

Description:
SpyShelter GUI

Version:
10,4,0,0

MD5:
24eb396f154127487e1c3ef851a98018

SHA-1:
70230575d683bceb63318b21afd8fc517c1e0b15

SHA-256:
094b093f65790d77d943d6600983c7efe5050c325bbfecaa7c03ce1beb785e99

Scanner detections:
5 / 68

Status:
Clean  (5 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
5/14/2024 4:47:43 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Crypt.XPACK.Gen3
7.11.30.172

IKARUS anti.virus
not-a-virus:AdWare.Amonetize
t3scan.1.9.5.0

Rising Antivirus
PE:Malware.RDM.17!5.17[F1]
23.00.65.151010

Vba32 AntiVirus
Malware-Cryptor.General.6
3.12.26.4

File size:
2.9 MB (3,029,768 bytes)

Product version:
10,4,0,0

Copyright:
(C) Datpol. All rights reserved.

Original file name:
SpyShelter.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\spyshelter free anti-keylogger\spyshelter.exe

Digital Signature
Signed by:
Datpol

Authority:
GlobalSign nv-sa

Valid from:
9/9/2015 5:37:53 PM

Valid to:
9/9/2016 5:37:53 PM

Subject:
CN=Datpol, O=Datpol, L=Olkusz, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C3B40F5627D2C5927A0D3740680419CC

File PE Metadata
Compilation timestamp:
10/12/2015 11:56:40 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:GXG1LeJesfiKoZejxNm65QsDiwl+Or61RKSu/dsmMPP88ru5gJesfT:GXwmemBoZe1Nm6huwAOmvlZP88regJZf

Entry address:
0x789271

Entry point:
EB, 08, 4D, E6, 29, 00, 00, 00, 00, 00, E9, 2C, FE, D8, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
2.8 MB (2,921,472 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SpyShelter

Command:
C:\Program Files\spyshelter free anti-keylogger\spyshelter.exe


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to spyshelter.com  (92.51.134.197:80)

Scan SpyShelter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.