home

SpywareClearUpdate.exe

Spyware Clear

Crawler, LLC

The application SpywareClearUpdate.exe, “Spyware Clear Update Support” by Crawler has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘SpywareClearUpdater’. While running, it connects to the Internet address b3da258c.virtua.com.br on port 6881.
Publisher:
Crawler.com  (signed by Crawler, LLC)

Product:
Spyware Clear

Description:
Spyware Clear Update Support

Version:
1.3.0.5

MD5:
f8d7e7c7821dd83065cacb6af6672099

SHA-1:
22e4e61e4100e548a2d538c99f663fe5cfb73bd0

SHA-256:
7061dc2fb2b30911aace5892960d63bd5581717c64b7176b52f8784c4b3c3a3a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 10:09:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Crawler.S
14.8.29.1

File size:
5.2 MB (5,441,928 bytes)

Product version:
1.3.0.0

Copyright:
© Crawler.com

Original file name:
SpywareClearUpdate.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\spyware clear\spywareclearupdate.exe

Digital Signature
Signed by:
Crawler, LLC

Authority:
VeriSign, Inc.

Valid from:
11/26/2013 7:00:00 PM

Valid to:
1/25/2017 6:59:59 PM

Subject:
CN="Crawler, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Crawler, LLC", L=Boca Raton, S=Florida, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
48E3A7F6CBA47D0C3FCD17CF81AB3F76

File PE Metadata
Compilation timestamp:
7/28/2014 7:14:59 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:Be199ukX3UJChes/8/hSQmcSAQKtL39jwyhnNhQmHTZdaiGobHPMa4LJ2HeVN3ij:BefUJtsGQKt7Flht2obHEfLL2NxqaKlk

Entry address:
0x2AD944

Entry point:
55, 8B, EC, 83, C4, F0, B8, E8, 06, 6A, 00, E8, 90, E4, D5, FF, E8, 57, 2A, FF, FF, E8, 1A, 9C, D5, FF, 8B, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6222

Developed / compiled with:
Microsoft Visual C++

Code size:
2.7 MB (2,801,664 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SpywareClearUpdater

Command:
C:\Program Files\spyware clear\spywareclearupdate.exe


The executing file has been seen to make the following network communications in live environments.

TCP:
Connects to u151-100.static.grapesc.cz  (93.91.151.100:6881)

TCP:
Connects to p54ADFA8E.dip0.t-ipconnect.de  (84.173.250.142:54414)

TCP:
Connects to host1845320937.direcway.com  (184.53.37.209:6881)

TCP:
Connects to host-184-174-180-238.VALOLT1.epbfi.com  (184.174.180.238:6881)

TCP:
Connects to hn.kd.ny.adsl  (42.236.179.121:9414)

TCP:
Connects to bb68f620.virtua.com.br  (187.104.246.32:6881)

TCP:
Connects to b3da258c.virtua.com.br  (179.218.37.140:6881)

TCP:
Connects to 173-25-87-115.client.mchsi.com  (173.25.87.115:6881)

TCP:
Connects to 173-167-245-126-ip-static.hfc.comcastbusiness.net  (173.167.245.126:6881)

Remove SpywareClearUpdate.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.