home

video_upgrader.exe

Hearing

Mirror evidence - www.Hearing.com

The executable video_upgrader.exe, “Thou eventually machinery powder” has been detected as malware by 36 anti-virus scanners. This is a setup program which is used to install the application. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server. The file has been seen being downloaded from chaosium.com.
Publisher:
Mirror evidence - www.Hearing.com

Product:
Hearing

Description:
Thou eventually machinery powder

Version:
6.0.0.1

MD5:
bf4b1ab564613aa7efdf3d1a02a4969f

SHA-1:
8af1868679b017480b8de9a97ac632b1ef620628

SHA-256:
4e5d6b7822dab87ae267464292069e175656c5f54cce5929a5102bb5d65df428

Scanner detections:
36 / 68

Status:
Malware

Analysis date:
4/26/2024 6:06:55 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.84038
280

Agnitum Outpost
Trojan.Yakes
7.1.1

AhnLab V3 Security
Spyware/Win32.Zbot
2015.03.27

Avira AntiVirus
TR/TorSolar.A.31
3.6.1.96

avast!
Win32:Malware-gen
2014.9-160430

AVG
Win32/Cryptor
2017.0.2758

Baidu Antivirus
Trojan.Win32.Napolar
4.0.3.16430

Bitdefender
Gen:Variant.Zusy.84038
1.0.20.605

Bkav FE
W32.FoidoaLTAJ.Trojan
1.3.0.6379

Comodo Security
UnclassifiedMalware
21556

Dr.Web
Trojan.PWS.Panda.6131
9.0.1.0121

Emsisoft Anti-Malware
Gen:Variant.Zusy.84038
8.16.04.30.11

ESET NOD32
Win32/Napolar
10.11385

Fortinet FortiGate
W32/Injector.AZFU!tr
4/30/2016

F-Prot
W32/S-b5b2e569
v6.4.7.1.166

F-Secure
Gen:Variant.Zusy.84038
11.2016-30-04_7

G Data
Gen:Variant.Zusy.84038
16.4.25

IKARUS anti.virus
Worm.Win32.Ngrbot
t3scan.1.8.9.0

K7 AntiVirus
Trojan
13.202.15399

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.283

Malwarebytes
Trojan.Inject.ED
v2016.04.30.11

McAfee
PWSZbot-FSR!BF4B1AB56461
5600.6414

Microsoft Security Essentials
Trojan:Win32/Napolar.A
1.1.11502.0

MicroWorld eScan
Gen:Variant.Zusy.84038
17.0.0.363

NANO AntiVirus
Trojan.Win32.Yakes.ctqqrz
0.30.8.659

Norman
Obfuscated_J.PLH
11.20160430

Panda Antivirus
Trj/Crilock.C
16.04.30.11

Qihoo 360 Security
HEUR/Malware.QVM10.Gen
1.0.0.1015

Quick Heal
Worm.Gamarue.I5
4.16.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.167A623E!377119294
23.00.65.16428

Sophos
Mal/Inject-EQ
4.98

Trend Micro House Call
TROJ_SPNR.35CD14
7.2.121

Trend Micro
TROJ_SPNR.35CD14
10.465.30

VIPRE Antivirus
Worm.Win32.Dorkbot.b
38818

ViRobot
Trojan.Win32.S.Zbot.212992.BC[h]
2014.3.20.0

Zillya! Antivirus
Trojan.Napolar.Win32.19
2.0.0.2118

File size:
208 KB (212,992 bytes)

Product version:
6.0

Copyright:
Copyright (C) Hearing 2004-2013

File type:
Executable application (Win32 EXE)

Language:
Árabe (Arábia Saudita)

Common path:
C:\users\{user}\downloads\video_upgrader.exe

File PE Metadata
Compilation timestamp:
2/18/2014 7:48:33 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:XCnkYy6+kUwzwCRLzXgwQyGRbza/Wf9Lk:XCnkxOwgkryOzPF4

Entry address:
0x16EF

Entry point:
E8, 78, 27, 00, 00, E9, 89, FE, FF, FF, B8, C0, CD, 40, 00, C3, A1, C0, 77, 4E, 00, 56, 6A, 14, 5E, 85, C0, 75, 07, B8, 00, 02, 00, 00, EB, 06, 3B, C6, 7D, 07, 8B, C6, A3, C0, 77, 4E, 00, 6A, 04, 50, E8, 26, 28, 00, 00, 59, 59, A3, A0, 67, 4E, 00, 85, C0, 75, 1E, 6A, 04, 56, 89, 35, C0, 77, 4E, 00, E8, 0D, 28, 00, 00, 59, 59, A3, A0, 67, 4E, 00, 85, C0, 75, 05, 6A, 1A, 58, 5E, C3, 33, D2, B9, C0, CD, 40, 00, EB, 05, A1, A0, 67, 4E, 00, 89, 0C, 02, 83, C1, 20, 83, C2, 04, 81, F9, 40, D0, 40, 00, 7C, EA, 6A...
 
[+]

Code size:
29 KB (29,696 bytes)

The file video_upgrader.exe has been seen being distributed by the following URL.

http://chaosium.com/?nlvh8h=f728db508

Remove video_upgrader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.