home

jutched.exe

The application jutched.exe has been detected as a potentially unwanted program by 40 anti-malware scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Java Update Manager’. While running, it connects to the Internet address WIN-3TP09L1A4DL on port 1866.
MD5:
ef27e54497c8031a18d451c29813b072

SHA-1:
2e5806f1827f1b60b8d8fda55090f991c05c9590

SHA-256:
ab2354f2b500136b6a282e0ef8dbe94d69b1e4c4917014937c8eb6d27e0b79f1

Scanner detections:
40 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 9:09:07 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.FakeAlert.CNB
245

Agnitum Outpost
Worm.Zeroll
7.1.1

AhnLab V3 Security
Win32/Pushbot.worm.116224.B
2014.07.09

Avira AntiVirus
TR/Crypt.ZPACK.Gen
7.11.159.66

avast!
Win32:Zeroll [Wrm]
2014.9-160604

AVG
Win32/DH.FF820002{NIETeW5+UIEHHFNPFVGBCQMJRA8gJCJ8}
2017.0.2723

Baidu Antivirus
Worm.Win32.Zeroll
4.0.3.1664

Bitdefender
Trojan.FakeAlert.CNB
1.0.20.780

Bkav FE
W32.Clod166.Trojan
1.3.0.4959

Clam AntiVirus
Worm.Zeroll-5
0.98/21411

Comodo Security
Heur.Suspicious
18809

Dr.Web
Trojan.IMspam.12
9.0.1.0156

Emsisoft Anti-Malware
Trojan.FakeAlert.CNB
8.16.06.04.02

ESET NOD32
Win32/Boberog.AZ
10.10064

Fortinet FortiGate
W32/Boberog.AZ!tr
6/4/2016

F-Prot
W32/Trojan2.NOID
v6.4.7.1.166

F-Secure
Trojan.FakeAlert.CNB
11.2016-04-06_7

G Data
Trojan.FakeAlert.CNB
16.6.24

IKARUS anti.virus
IM-Worm.Win32.Zeroll
t3scan.1.6.1.0

K7 AntiVirus
NetWorm
13.180.12657

Kaspersky
IM-Worm.Win32.Zeroll
14.0.0.110

Malwarebytes
Trojan.Agent.PS
v2016.06.04.02

McAfee
Artemis!EF27E54497C8
5600.6379

Microsoft Security Essentials
Worm:Win32/Pushbot.gen!C
1.10701

MicroWorld eScan
Trojan.FakeAlert.CNB
17.0.0.468

NANO AntiVirus
Trojan.Win32.Zeroll.biutw
0.28.0.60698

Norman
Suspicious_Gen2.GDJFK
11.20160604

nProtect
Worm/W32.Zeroll.41472
14.07.08.03

Panda Antivirus
Adware/NaviPromo
16.06.04.02

Qihoo 360 Security
Win32/RootKit.Rootkit.4ff
1.0.0.1015

Quick Heal
I-Worm.Zeroll.r5
6.16.14.00

Sophos
W32/IMBot-A
4.98

SUPERAntiSpyware
Trojan.Agent/Gen
9103

Total Defense
Win32/Zeroll.B
37.0.11046

Trend Micro House Call
WORM_ZEROLL_0000000.TOMA
7.2.156

Trend Micro
WORM_ZEROLL_0000000.TOMA
10.465.04

Vba32 AntiVirus
Malware-Cryptor.Limpopo
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
31088

ViRobot
Worm.Win32.A.IM-Zeroll.70144
2011.4.7.4223

Zillya! Antivirus
Worm.Zeroll.Win32.32
2.0.0.1850

File size:
40.5 KB (41,472 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\public\hex-5823-6893-6818\jutched.exe

File PE Metadata
Compilation timestamp:
9/4/2010 8:53:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
768:YHW3a0bZcxJe9yN+lewLr7jxB7h1+hPiIg:WWq0dcx09yNmtfxBFCqIg

Entry address:
0x2060

Entry point:
55, 8B, EC, 6A, FF, 68, 78, 32, 00, 10, 68, E6, 21, 00, 10, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 7C, 30, 00, 10, 59, 83, 0D, 4C, 49, 00, 10, FF, 83, 0D, 50, 49, 00, 10, FF, FF, 15, 80, 30, 00, 10, 8B, 0D, 40, 49, 00, 10, 89, 08, FF, 15, 84, 30, 00, 10, 8B, 0D, 3C, 49, 00, 10, 89, 08, A1, 88, 30, 00, 10, 8B, 00, A3, 48, 49, 00, 10, E8, 16, 01, 00, 00, 39, 1D, C0, 47, 00, 10, 75, 0C, 68, E2, 21, 00, 10, FF, 15, 8C, 30...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
5 KB (5,120 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Java Update Manager

Command:
C:\users\public\hex-5823-6893-6818\jutched.exe


The executing file has been seen to make the following network communications in live environments.

TCP:
Connects to WIN-3TP09L1A4DL  (61.19.30.71:1866)

TCP:
Connects to unallocated.barefruit.co.uk  (92.242.140.21:1866)

Remove jutched.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.