home

blackberry mep reader.exe

The executable blackberry mep reader.exe has been detected as malware by 33 anti-virus scanners. This is a setup program which is used to install the application. This is a trojan Bot that uses IRC to communicate with a comand and control network. The Trojan drops other malicious software and opens a backdoor on the infected computer and will run automatically on each boot. The file has been seen being downloaded from powr.s3.amazonaws.com and multiple other hosts.
MD5:
e6bb15c8d29743da022617075b51b2e8

SHA-1:
43def284ebb9ebf1023d7f42b6ad1cbd21f60ac9

SHA-256:
8f9ae828bf7718f3da934bc80a990ac90b098a6fbc0e8a26d90ae4b16e1ed5c7

Scanner detections:
33 / 68

Status:
Malware

Explanation:
Part of a backdoor IRC bot network.

Analysis date:
11/6/2024 2:23:36 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Trojan.Heur.RP.kzWaaGIj39di
1133

Agnitum Outpost
TrojanSpy.Delf
7.1.1

AhnLab V3 Security
ASD.Prevention
2014.01.05

Avira AntiVirus
TR/Gendal.1214464.C
7.11.123.132

AVG
PSW.Generic10
2014.0.3611

Baidu Antivirus
Trojan.Win32.Delf
4.0.3.131228

Bitdefender
Gen:Trojan.Heur.RP.kzWaaGIj39di
1.0.20.1810

Bkav FE
W32.OnlieLogER.Trojan
1.3.0.4613

Comodo Security
UnclassifiedMalware
17552

Dr.Web
Trojan.PWS.Spy.10123
9.0.1.0362

Emsisoft Anti-Malware
Gen:Trojan.Heur.RP.kzWaaGIj39di
8.13.12.28.06

F-Prot
W32/Themida_Packed
v6.4.7.1.166

F-Secure
Gen:Trojan.Heur.RP.kzWaaGIj39di
11.2013-28-12_7

G Data
Gen:Trojan.Heur.RP.kzWaaGIj39di
13.12.22

IKARUS anti.virus
Trojan-Dropper.Delf
t3scan.2.2.29

K7 AntiVirus
Trojan
13.175.10735

Kaspersky
Trojan-Spy.Win32.Delf
14.0.0.4551

Malwarebytes
Spyware.PWS
v2013.12.28.06

McAfee
Artemis!E6BB15C8D297
5600.7267

MicroWorld eScan
Gen:Trojan.Heur.RP.kzWaaGIj39di
14.0.0.1086

NANO AntiVirus
Trojan.Win32.Delf.cducq
0.28.0.57029

Norman
Suspicious_Gen2.PBSK
11.20131228

nProtect
Trojan/W32.Agent.1214464.H
14.01.03.01

Panda Antivirus
Trj/Downloader.NXI
13.12.28.06

Rising Antivirus
PE:Trojan.Win32.Generic.1292CE5C!311610972
23.00.65.131226

Sophos
Mal/Generic-L
4.96

Total Defense
Win32/Bancos.ACAO
37.0.10498

Trend Micro House Call
TROJ_SPNR.0BHL11
7.2.362

Trend Micro
TROJ_SPNR.0BHL11
10.465.28

Vba32 AntiVirus
TrojanSpy.Delf
3.12.24.3

VIPRE Antivirus
Backdoor.Win32.Ircbot.gen
25082

ViRobot
Trojan.Win32.S.Delf.1214464
2011.4.7.4223

XVirus List
Win.Detected
2.3.31

File size:
1.2 MB (1,214,464 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\blackberry mep reader.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FprQ5EyYaKuNbUCR10XIP8OyvPHO3u9rRGXeXuCBlGE:FpPZaKt1u3BVbE

Entry address:
0x29F000

Entry point:
83, EC, 04, 50, 53, E8, 01, 00, 00, 00, CC, 58, 8B, D8, 40, 2D, 00, D0, 0E, 00, 2D, 5D, 36, 5F, 00, 05, 52, 36, 5F, 00, 80, 3B, CC, 75, 19, C6, 03, 00, BB, 00, 10, 00, 00, 68, 3E, E4, 95, 4D, 68, 2B, 6E, 88, 2D, 53, 50, E8, 0A, 00, 00, 00, 83, C0, 00, 89, 44, 24, 08, 5B, 58, C3, 55, 8B, EC, 60, 8B, 75, 08, 8B, 4D, 0C, C1, E9, 02, 8B, 45, 10, 8B, 5D, 14, EB, 08, 31, 06, 01, 1E, 83, C6, 04, 49, 0B, C9, 75, F4, 61, C9, C2, 10, 00, 00, 7E, 17, 8D, F9, 7D, 91, F5, B3, A6, CB, 3A, F9, 70, EA, 68, C0, EC, A3, 79...
 
[+]

Code size:
433.5 KB (443,904 bytes)

The file blackberry mep reader.exe has been seen being distributed by the following 2 URLs.

https://powr.s3.amazonaws.com/app_images/resizable/.../IMEI & MEP Reader.exe

http://s10191.chomikuj.pl/File.aspx?e=CeqHSVGMVaZXDdzAB2yDTce61XbcsdlKiF5_8Q6GtdhPVfjOMgq5DcSo7pZPo82VEizV-FBV3eEfn_yeKyFdWrDWrFahrSivDqE1UwEkD53F2GeEs3oRalu01cKkWmEYLH-u0U9RXfObiDaKgEW9PsRJfTIZDSaK8wvv7avYWz8&pv=2

Remove blackberry mep reader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.