» tera-term.exe
Overview
Analysis
File Details
Downloads (1)

tera-term.exe

UpdateStar GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application tera-term.exe by UpdateStar GmbH has been detected as a potentially unwanted program by 23 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.updatestar.com.

File name:

tera-term.exe

Publisher:

UpdateStar GmbH (signed and verified)

MD5:

0e2e04cbce8129741a7f38e968c269a0

SHA-1:

5334b77726ba7f837f22a40060731da5b72f60d2

SHA-256:

c6a8d25c07c1a709e24b597c31c0dd3a267e01fc8a07c182e09cad78256f23b9

Scanner detections:

23 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/24/2024 11:48:44 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

1027

Agnitum Outpost

Trojan.MulDrop

7.1.1

Avira AntiVirus

Adware/InstallCore.A.169

7.11.141.178

AVG

MalSign.InstallC

2015.0.3505

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.14413

Bitdefender

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

1.0.20.515

Comodo Security

Application.Win32.InstallCore.BWAN

18064

Dr.Web

Trojan.MulDrop5.10078

9.0.1.0103

Emsisoft Anti-Malware

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

8.14.04.13.09

ESET NOD32

Win32/InstallCore.LX (variant)

8.9646

Fortinet FortiGate

Riskware/InstallCore

4/13/2014

F-Secure

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

11.2014-13-04_1

G Data

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

14.4.24

IKARUS anti.virus

Trojan.Win32.Spy2.GZ.PGZ@bqkIzwki

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11684

Malwarebytes

PUP.Optional.Installcore

v2014.04.13.09

McAfee

Artemis!0E2E04CBCE81

5600.7161

MicroWorld eScan

Gen:Trojan.Heur2.GZ.PGZ@bqkIzwki

15.0.0.309

Qihoo 360 Security

Win32/Virus.Adware.94c

1.0.0.1015

Reason Heuristics

PUP.UpdateStarGmbH.J

14.4.13.21

Sophos

Install Core Installer

4.98

Trend Micro House Call

TROJ_GEN.F47V0402

7.2.103

VIPRE Antivirus

Adware.Win32.InstallCore.ba

28115

File size:

668.1 KB (684,088 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\tera-term.exe

Digital Signature

Signed by:

UpdateStar GmbH

Authority:

COMODO CA Limited

Valid from:

1/1/2013 7:00:00 PM

Valid to:

1/2/2016 6:59:59 PM

Subject:

CN=UpdateStar GmbH, O=UpdateStar GmbH, STREET=Hauptstraße 20, L=Berlin, S=Berlin, PostalCode=10827, C=DE

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

009ED227324380B40DDE36C8D31A33831F

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:0EnvpPgfwvLYDZtzRgNoU+9qu9OToO6bXUk+t3Nbsd2T33v3ldbrT:0EnvtiwTYDZtzWoL9qmOsOn9Ad2T33v3

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8046

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file tera-term.exe has been seen being distributed by the following URL.

http://www.updatestar.com/.../2037688

Remove tera-term.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.