home

360safe.exe

The executable 360safe.exe, “深蓝TCP维护通道(DBNT) 客户端” has been detected as malware by 34 anti-virus scanners. According to AVG, this software downloads additional adware offers during setup. While running, it connects to the Internet address ip-172-19-216-253.ec2.internal on port 21984.
Description:
深蓝TCP维护通道(DBNT) 客户端

Version:
7.5.0.10

MD5:
635bf105d3910980c12e1e202f911aad

SHA-1:
29109a2c9e5e653aa24f6771a5b766f314c14e59

SHA-256:
e79c98448dd16624f2e46b17e2c49c0948646447d3915ba6745784a9733ca94a

Scanner detections:
34 / 68

Status:
Malware

Analysis date:
11/24/2024 2:30:57 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.10062559
540

Avira AntiVirus
TR/Autoit.433869
7.11.215.230

avast!
AutoIt:MalOb-AZ [Trj]
2014.9-150814

AVG
Downloader.Generic13
2016.0.3018

Bitdefender
Trojan.Generic.10062559
1.0.20.1130

Comodo Security
TrojWare.Win32.Hider.REXR
21364

Emsisoft Anti-Malware
Trojan.Generic.10062559
8.15.08.14.01

ESET NOD32
Win32/Packed.Autoit.H suspicious
9.11299

Fortinet FortiGate
W32/Generic
8/14/2015

F-Prot
W32/Trojan2.NVGH
v6.4.7.1.166

F-Secure
Trojan.Generic.10062559
11.2015-14-08_6

G Data
Trojan.Generic.10062559
15.8.25

K7 AntiVirus
Trojan-Downloader
13.200.15223

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.1585

McAfee
RDN/Downloader.a!to
5600.6674

MicroWorld eScan
Trojan.Generic.10062559
16.0.0.678

NANO AntiVirus
Trojan.Win32.Agent.dobukk
0.30.0.296

Norman
Troj_Generic.RNCRG
11.20150814

nProtect
Trojan.Generic.10062559
15.03.10.01

Reason Heuristics
Threat.Win.Reputation.IMP
15.8.14.1

Trend Micro House Call
TROJ_GEN.R08JC0FKD14
7.2.226

Trend Micro
TROJ_GEN.R08JC0FKD14
10.465.14

Vba32 AntiVirus
IMWorm.Sohanad
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
38306

ViRobot
Trojan.Win32.A.Agent.690283[UPX][h]
2014.3.20.0

File size:
423.7 KB (433,869 bytes)

Copyright:
深蓝 Thinking 版权所有 wglm@qq.com

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
2/5/2012 6:43:24 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:OfnnK9zABs+TbFx9SXOPCf8DkqAR8zHV8wshj+oYmSUzc:OfK9zUHFpi8/WwwjLnzc

Entry address:
0xC6750

Entry point:
60, BE, 00, C0, 47, 00, 8D, BE, 00, 50, F8, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.9134

Packer / compiler:
UPX 2.90LZMA

Code size:
300 KB (307,200 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP:
Connects to ip-172-19-216-253.ec2.internal  (172.19.216.253:21984)

TCP (HTTP):
Connects to 86.192.30.121.adsl-pool.sx.cn  (121.30.192.86:80)

Remove 360safe.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.