home

flux-setup.exe

The executable flux-setup.exe has been detected as malware by 6 anti-virus scanners. The program is a setup application that uses the Nullsoft Scriptable Install System installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from justgetflux.com.
MD5:
c946fea76db3a0b3aa03020de8a30d38

SHA-1:
29b918b1333f0ff7c3be9372e2af3445f8ae0688

SHA-256:
d121b66c44c07d1797b0b281e8cf11a4cbaea3281c9a6f860b5ecd637236827d

Scanner detections:
6 / 68

Status:
Malware

Analysis date:
11/23/2024 10:22:19 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

AVG
Win32/Sality
2015.0.4591

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

Microsoft Security Essentials
Threat.Undefined
1.225.1590.0

File size:
659.3 KB (675,128 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Scriptable Install System

Common path:
C:\users\{user}\downloads\flux-setup.exe

File PE Metadata
Compilation timestamp:
12/6/2009 4:20:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:WX6mwFNpKKrETxnxDWsMtGgvYGW621SMSTyte0eO9aVz2I8qCgQ:WXmNdMxkfBYt6CSfetveOE2I8qCgQ

Entry address:
0x30CB

Entry point:
41, 3C, BE, FF, C6, 89, F9, 24, 37, B7, B0, 8D, 0D, E5, 3D, ED, 9D, 0C, A6, B0, 0A, FE, CA, 40, C7, C7, DB, CF, 5C, DC, E8, 00, 00, 00, 00, 32, F4, F6, C2, 4F, 87, FB, F2, 8D, 1D, FC, 1E, FD, 0C, 8A, DF, 85, FD, 8A, D4, 2B, E9, 81, F9, 78, 43, 00, 00, 77, 09, 80, EF, 01, 8D, 35, B3, 9B, BB, 67, 59, 87, FE, 0A, F5, 76, 08, C6, C3, E0, 3D, E2, 68, 3C, DE, 81, C1, 08, E9, 0A, 00, 85, E9, 73, 05, F6, C2, DF, 86, E3, 81, E9, 05, 8F, 07, 00, 88, C3, BE, D6, 93, C2, 96, 0F, AF, DB, 69, EA, 6B, 55, CD, 4F, 30, FE...
 
[+]

Entropy:
7.9577  (probably packed)

Code size:
22.5 KB (23,040 bytes)

The file flux-setup.exe has been seen being distributed by the following URL.

https://justgetflux.com/flux-setup.exe

Remove flux-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.