home

instdrv_stdrk200.exe

ROCKEY200 Driver

Feitian Technologies Co.,Ltd

The executable instdrv_stdrk200.exe, “ROCKEY200 Driver Package” has been detected as malware by 12 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from dc379.4shared.com.
Publisher:
Feitian Technologies Co.,Ltd

Product:
ROCKEY200 Driver

Description:
ROCKEY200 Driver Package

Version:
2.5.6.1110

MD5:
15e293e8debb65bea8dc8243647578e4

SHA-1:
3fc1a9f1a315825207ad0c6df14f01f7d3a8741e

SHA-256:
50233430159158f1f383a04972d7d06ebc4a9d8568c59bc43ddf7329a3dd61d9

Scanner detections:
12 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/26/2024 4:34:48 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

AVG
Win32/Sality
2015.0.4591

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.96

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.223.2897.0

Norman
Win32.Sality.3
28.05.2016 15:32:18

VIPRE Antivirus
Threat.4721115
50266

File size:
2.1 MB (2,168,952 bytes)

Copyright:
Copyright(C) 2004-2005, Feitian Technologies Co.,Ltd

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\instdrv_stdrk200.exe

File PE Metadata
Compilation timestamp:
8/9/2005 3:30:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:JLl2ADcU6F0ThUz6Ul0zSmtLejSLK7zJPU56qQ3uY0:ZI9F0Tazgemt8L7zJM5euY0

Entry address:
0x402D

Entry point:
F6, C3, E0, 69, D0, D2, 5B, 56, 32, 39, C8, 32, C1, 47, 43, 80, FC, 5E, EB, 02, 84, C7, 51, F3, 21, F2, 5E, FE, CB, 76, 06, 0F, AF, FA, 0F, BE, EA, B9, B6, CD, 18, 23, 69, D3, 89, 22, AA, 9F, FE, C2, 73, 01, 46, B7, BE, C7, C3, E0, FC, A0, 19, E8, 47, 00, 00, 00, 86, D1, 8D, 3D, CB, D1, 34, A0, 22, C6, 20, C6, 85, F2, 77, 08, FF, C7, 81, D2, D5, 75, 9F, 1A, 80, EF, 28, 8A, DC, 80, CE, 6B, B8, 07, 00, 00, 00, C7, C6, A1, BE, ED, B0, 87, F3, 0F, AF, F5, 69, C0, A3, 01, 00, 00, F2, 8B, D8, 33, E8, 75, 0A, 0F...
 
[+]

Code size:
23 KB (23,552 bytes)

The file instdrv_stdrk200.exe has been seen being distributed by the following URL.

http://dc379.4shared.com/download/.../instdrv_stdrk200.exe

Remove instdrv_stdrk200.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.