home

emulador3dscitra__7934_il16325.exe

RusOil performer

RusOil

The application emulador3dscitra__7934_il16325.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from 989713.fullversiondownload.website.
Publisher:
RusOil

Product:
RusOil performer

Description:
RusOilBlah

Version:
78.94.0.333

MD5:
976fd03b2923a649fe11d11f364f10bf

SHA-1:
e0bc638ebdf2250af84ba2c15edecab72cf3f6d6

SHA-256:
31b6768ca66381ea69871a0277e2d2777ae202e08fb04e0af58e74270ae6d856

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/6/2024 12:37:26 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Amonitize
16.4.22.2

File size:
1 MB (1,090,756 bytes)

Product version:
78.0.0.99

Copyright:
RusOilBlah TM

Original file name:
rus.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\emulador3dscitra__7934_il16325.exe

File PE Metadata
Compilation timestamp:
3/10/2016 11:29:24 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:AUtA8WDAfp9q+TYNFjml15YGTZNmXvqngjBcn7NN:AUtW8sNFGpTZNmXvqqiBN

Entry address:
0xC2FE

Entry point:
E8, F5, 5D, 00, 00, E9, 39, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, D0, 5B, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, D0, 5B, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, A0, 00, 00...
 
[+]

Code size:
135.5 KB (138,752 bytes)

The file emulador3dscitra__7934_il16325.exe has been seen being distributed by the following URL.

http://989713.fullversiondownload.website/download3.php?x=f405167c520770d575f4f50b3750018d&id=dnew996&title=Emulador-3ds-Citra&u=ZW11bGFkb3IzZHMuY29t

Remove emulador3dscitra__7934_il16325.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.