» gputemp.exe
Overview
Analysis
File Details
Behaviors (1)
Downloads (1)

gputemp.exe

White Sea Media

The application gputemp.exe by White Sea Media has been detected as adware by 11 anti-malware scanners. This is a setup program which is used to install the application. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘GPUTemp’. This is a trojan Bot that uses IRC to communicate with a comand and control network. The Trojan drops other malicious software and opens a backdoor on the infected computer and will run automatically on each boot.

File name:

gputemp.exe

Publisher:

White Sea Media (signed and verified)

MD5:

2e99f4134cb2659fdf1e4f3083a806e2

SHA-1:

acfa6b3143fe6dea9e97d878f9dbf134ad72d2b5

SHA-256:

e118afe77c39cdaf0328d34cf8d2558414e203f47a8a1eeac773f2d4accb560b

Scanner detections:

11 / 68

Status:

Adware

Explanation:

Part of a backdoor IRC bot network.

Analysis date:

11/5/2024 9:51:50 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Downloader.JQGJ

1151

Bitdefender

Trojan.Downloader.JQGJ

1.0.20.1720

Emsisoft Anti-Malware

Trojan.Downloader.JQGJ

8.13.12.10.04

F-Secure

Trojan.Downloader.JQGJ

11.2013-10-12_3

G Data

Trojan.Downloader.JQGJ

13.12.22

IKARUS anti.virus

Trojan-Downloader

t3scan.2.2.29

McAfee

Artemis!2E99F4134CB2

5600.7285

MicroWorld eScan

Trojan.Downloader.JQGJ

14.0.0.1032

Reason Heuristics

PUP.Startup.WhiteSeaMedia.H

14.8.7.21

Trend Micro House Call

TROJ_GEN.F47V1129

7.2.344

VIPRE Antivirus

Backdoor.Win32.Ircbot.gen

24070

File size:

1.3 MB (1,328,352 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\local\temp\gputemp.exe

Digital Signature

Signed by:

White Sea Media

Authority:

COMODO CA Limited

Valid from:

7/8/2013 3:00:00 AM

Valid to:

7/9/2014 2:59:59 AM

Subject:

CN=White Sea Media, O=White Sea Media, STREET=4142 Mariner Blvd, L=Spring Hill, S=FL, PostalCode=34609, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

1FB235ACA7565BA27ADC702B2BD05C7F

File PE Metadata

Compilation timestamp:

11/28/2013 11:42:16 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:usSJPYEO1G5YCnP0NwJpJt47DLZQy0AftHsBTmQ9IlW7UPeBobRM3:jSJ9YSPEmtEDiAfkT2EUqoC

Entry address:

0x355000

Entry point:

83, EC, 04, 50, 53, E8, 01, 00, 00, 00, CC, 58, 89, C3, 40, 2D, 00, 80, 13, 00, 2D, 8F, 8E, 0A, 10, 05, 84, 8E, 0A, 10, 80, 3B, CC, 75, 19, C6, 03, 00, BB, 00, 10, 00, 00, 68, BF, FF, B2, 6A, 68, A0, 1A, 50, 14, 53, 50, E8, 0A, 00, 00, 00, 83, C0, 00, 89, 44, 24, 08, 5B, 58, C3, 55, 89, E5, 50, 53, 51, 56, 8B, 75, 08, 8B, 4D, 0C, C1, E9, 02, 8B, 45, 10, 8B, 5D, 14, 85, C9, 74, 0A, 31, 06, 01, 1E, 83, C6, 04, 49, EB, F2, 5E, 59, 5B, 58, C9, C2, 10, 00, A9, C5, F4, D3, 76, 6B, 67, 1A, 45, 12, 3A, 87, AC, 17... 
[+]

Code size:

41 KB (41,984 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

GPUTemp

Command:

"C:\users\{user}\appdata\local\temp\gputemp.exe"

The file gputemp.exe has been seen being distributed by the following URL.

http://downloads.shoppingsuggestion.com/GPUTemp6.exe

Remove gputemp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.