home

5d2867.exe

The executable 5d2867.exe has been detected as malware by 39 anti-virus scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘5D2867’.
MD5:
2e6777d13ab0eb97f0225f9788a29c38

SHA-1:
9e1bb64d30233505de532f4370caf23264846191

SHA-256:
ed0aff9c4f40b14c5e3f194ea3f6e7f94b73a05d44a640d2440c38ca9740a65c

Scanner detections:
39 / 68

Status:
Malware

Analysis date:
11/27/2024 4:52:56 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
GenPack:Backdoor.Generic.184365
788

Agnitum Outpost
Worm.Autorun
7.1.1

AhnLab V3 Security
Win32/Flystudio.worm.Gen
2014.03.01

Avira AntiVirus
TR/Dropper.Gen
7.11.133.252

avast!
Win32:Flystud-Q [Trj]
2014.9-141209

AVG
Worm/Generic
2015.0.3266

Baidu Antivirus
Trojan.Win32.Scar
4.0.3.14129

Bitdefender
GenPack:Backdoor.Generic.184365
1.0.20.1715

Bkav FE
W32.FlyStudioTn
1.3.0.4959

Clam AntiVirus
Worm.FlyStudio-28
0.98/18355

Comodo Security
TrojWare.Win32.TrojanDropper.Flystud.ko
17861

Dr.Web
Win32.HLLW.Autoruner.26035
9.0.1.0343

Emsisoft Anti-Malware
GenPack:Backdoor.Generic.184365
8.14.12.09.06

ESET NOD32
Win32/AutoRun.FlyStudio.IY
8.9483

Fortinet FortiGate
W32/PckdFlyStudio.gen
12/9/2014

F-Prot
W32/Nuj.A.gen
v6.4.7.1.166

F-Secure
Trojan-Dropper:W32/Peed.gen!A
11.2014-09-12_3

G Data
GenPack:Backdoor.Generic.184365
14.12.24

IKARUS anti.virus
Virus.Win32.Sality
t3scan.2.2.29

K7 AntiVirus
Trojan
13.176.11302

Kaspersky
Trojan.Win32.Scar
14.0.0.2824

Malwarebytes
Worm.AutoRun
v2014.12.09.06

McAfee
W32/Autorun.worm.ev
5600.6922

Microsoft Security Essentials
Worm:Win32/Autorun.JN
1.10302

MicroWorld eScan
GenPack:Backdoor.Generic.184365
15.0.0.1029

NANO AntiVirus
Virus.Win32.Sality.bgiylc
0.28.0.58101

Norman
FlyAgent.CX
11.20141209

nProtect
Trojan/W32.Agent.1462734
14.02.28.01

Panda Antivirus
Bck/Wutau.B
14.12.09.06

Qihoo 360 Security
Win32/Trojan.323
1.0.0.1015

Quick Heal
Backdoor.FlyAgent.F
12.14.12.00

Rising Antivirus
PE:Malware.FakeFolder@CV!1.6AA9
23.00.65.141207

Sophos
Mal/EncPk-NB
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-XPFraud
10188

Total Defense
Win32/Nuj.B!generic
37.0.10790

Trend Micro House Call
WORM_FLYSTUDI.B
7.2.343

Trend Micro
WORM_FLYSTUDI.B
10.465.09

Vba32 AntiVirus
TrojanDownloader.FlyStudio
3.12.24.3

VIPRE Antivirus
Trojan.Win32.Autorun.dm
26928

File size:
1.4 MB (1,462,734 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\3a84bc\5d2867.exe

File PE Metadata
Compilation timestamp:
12/25/1972 8:33:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
4.0

CTPH (ssdeep):
24576:ph76bbJPjwbJW8tweTYhI1u0PdlLokm+/d938FRyK9wr3tP:phMNwbtDkgPdFFRV1sub5

Entry address:
0x1314

Entry point:
52, F9, 56, 57, 50, 53, 51, 0F, 82, BB, FF, FF, FF, C8, 25, CE, 09, 62, 2B, 80, DF, 5A, 14, 9B, 54, EB, CF, 59, 87, 47, 0F, 85, 4A, FE, FF, FF, E9, AD, FE, FF, FF, BC, 59, 8E, D0, F7, AD, 39, 00, 16, 84, 59, EA, BD, A3, 02, 22, BE, E4, AF, 04, 95, 26, DA, F8, 9B, A9, CA, F5, 7D, BB, AD, 44, ED, 95, E6, 87, 97, 80, A8, F9, 57, 3C, C4, 83, C2, FF, F8, 0F, 83, C0, FF, FF, FF, A9, A1, BF, C0, 61, 87, 28, 79, 9C, E4, 28, 74, F6, 34, 5B, B1, FD, 1E, DE, A5, E6, 54, AA, 3B, 7F, BB, 20, 19, 65, CC, E4, 24, 77, 3A...
 
[+]

Entropy:
7.8228  (probably packed)

Code size:
24 KB (24,576 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
5D2867

Command:
C:\Windows\System32\3a84bc\5d2867.exe


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ec2-52-0-217-44.compute-1.amazonaws.com  (52.0.217.44:80)

Remove 5d2867.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.