home

setup-lightshot.exe

lightshot

Skillbrains

The executable setup-lightshot.exe, “lightshot Setup ” has been detected as malware by 38 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from app.prntscr.com.
Publisher:
Skillbrains

Product:
lightshot

Description:
lightshot Setup

Version:
5.2.1.1

MD5:
175d1c90044944cfe403657485849d8e

SHA-1:
188a43be12f3e9ab93fdf8be053e939125db1c31

SHA-256:
6e1ed30e6b6451cfcc5e25438106b2e71817d4d15fadf42538f565bd2e4a5386

Scanner detections:
38 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
8/20/2026 3:29:38 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
5697946

Agnitum Outpost
Win32.Sality.BK
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2015.12.10

Avira AntiVirus
W32/Sality.AT
7.11.30.172

Arcabit
Win32.Sality.3
1.0.0.629

avast!
Win32:SaliCode
151205-4

AVG
Win32/Sality
2015.0.4477

Baidu Antivirus
Virus.Win32.Sality.$Emu
4.0.3.15129

Bitdefender
Win32.Sality.3
1.0.20.1715

Bkav FE
W32.Sality.PE
1.3.0.7383

Comodo Security
Virus.Win32.Sality.gen
23732

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.21

G Data
Win32.Sality
15.12.25

IKARUS anti.virus
Virus.Win32.Sality
t3scan.1.9.5.0

K7 AntiVirus
Virus
13.212.18054

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Virus:Win32/Sality.AU
1.1.12300.0

MicroWorld eScan
Win32.Sality.3
16.0.0.1029

NANO AntiVirus
Virus.Win32.Sality.beygb
1.0.10.5081

Norman
Win32.Sality.3
28.10.2015 12:55:53

nProtect
Virus/W32.Sality.D
15.12.09.01

Panda Antivirus
W32/Sality.AA
15.12.09.03

Qihoo 360 Security
Virus.Win32.Sality.I
1.0.0.1077

Quick Heal
W32.Sality.U
12.15.14.00

Rising Antivirus
PE:Virus.Sality!1.A09C [F]
23.00.65.151207

Sophos
Virus 'Mal/Sality-D'
5.21

Total Defense
Win32/Sality.AA
37.1.62.1

Trend Micro House Call
PE_SALITY.RL
7.2.343

Trend Micro
PE_SALITY.RL
10.465.09

Vba32 AntiVirus
Virus.Win32.Sality.bakb
3.12.26.4

VIPRE Antivirus
Threat.4721115
45686

ViRobot
Win32.Sality.Gen.A[h]
2014.3.20.0

Zillya! Antivirus
Virus.Sality.Win32.25
2.0.0.2556

File size:
2.5 MB (2,593,280 bytes)

Product version:
5.2.1.1

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
7/9/2014 4:58:13 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:Vv/mCxjt0z99Vu1uqJoLlF6Q6TEra5sjHO5OqNOT4upOZq9:V/mCttQzU1lJoJF/6TEi0XcO9

Entry address:
0x113BC

Entry point:
60, 0F, B7, C1, 88, EA, 8D, 3D, 22, 0C, 1E, 00, C7, C7, EE, 19, FA, 38, 0F, BF, DA, 73, 06, 86, C7, 84, C8, 29, CE, C7, C5, 8D, 36, 78, E7, F3, 0F, B6, D6, 45, 21, C3, F7, C5, 0F, 38, D4, 8F, 0F, AF, E8, E8, 00, 00, 00, 00, 5D, 0F, AF, D2, 68, 1D, AB, 89, 00, 68, BD, B3, E5, 00, F2, B8, 22, A6, 55, 26, 81, FB, AE, E2, 00, 00, 72, 0A, 0F, AF, FF, 35, BE, 51, B2, 10, 8B, FA, 84, E0, 41, 40, 40, C6, C2, 6B, 03, F3, FF, CF, 84, DC, 8D, 05, C5, 4B, 70, 56, 88, EF, 86, DA, 0F, BF, FF, 0B, D3, C6, C1, A2, EB, 06...
 
[+]

Code size:
63.5 KB (65,024 bytes)

The file setup-lightshot.exe has been seen being distributed by the following URL.

http://app.prntscr.com/.../setup-lightshot.exe

Remove setup-lightshot.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.