home

flashplayer_update.exe

The executable flashplayer_update.exe has been detected as malware by 22 anti-virus scanners. This is a setup program which is used to install the application. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from www.freembtc.net.
Version:
15.0.0.0

MD5:
77493aca32da3a2263e8b602351a49d6

SHA-1:
e907432ebead3f714122ce17357fd804708bc652

SHA-256:
c3d1a76ed0f5d8b3cb76b4f1f7a945a7b8efc9795401a44bf62c834da4a2b8de

Scanner detections:
22 / 68

Status:
Malware

Analysis date:
1/1/2025 3:22:57 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2761270
385

Avira AntiVirus
TR/Dldr.Agent.382976.7
8.3.2.2

Arcabit
Trojan.Generic.D2A2236
1.0.0.576

avast!
MSIL:Banker-DO [Trj]
2014.9-160116

AVG
Downloader.MSIL
2017.0.2863

Bitdefender
Trojan.GenericKD.2761270
1.0.20.80

Emsisoft Anti-Malware
Trojan.GenericKD.2761270
8.16.01.16.05

ESET NOD32
MSIL/TrojanDownloader.Banload.EU (variant)
10.12366

Fortinet FortiGate
MSIL/Banload.EV!tr.dldr
1/16/2016

F-Secure
Trojan.GenericKD.2761270
11.2016-16-01_7

G Data
Trojan.GenericKD.2761270
16.1.25

IKARUS anti.virus
Trojan-Downloader.MSIL.Banload
t3scan.1.9.5.0

K7 AntiVirus
Trojan-Downloader
13.210.17446

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.809

McAfee
Artemis!77493ACA32DA
5600.6519

Microsoft Security Essentials
TrojanDownloader:MSIL/Banload
1.1.12101.0

MicroWorld eScan
Trojan.GenericKD.2761270
17.0.0.48

nProtect
Trojan.GenericKD.2761270
15.10.06.01

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Rising Antivirus
PE:Malware.RDM.39!5.2D[F1]
23.00.65.16114

Sophos
Mal/Generic-S
4.98

VIPRE Antivirus
Trojan.Win32.Generic
44338

File size:
374 KB (382,976 bytes)

Product version:
15.0.0.0

Copyright:
Copyright © 2015

Original file name:
PUSH.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flashplayer_update.exe

File PE Metadata
Compilation timestamp:
9/29/2015 12:18:23 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:6zJ+lM+sEvWfROJLhfJpreQ00ws/R3b/rz3qhO32GhNv4xofifmZzlOpLCnQhS96:pWROJNhpeBUDnq+2GhNgL3U9502V+

Entry address:
0x368EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
210.5 KB (215,552 bytes)

The file flashplayer_update.exe has been seen being distributed by the following URL.

http://www.freembtc.net/link.php

Remove flashplayer_update.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.