home

Launcher.exe

JMK Mu Launcher

Jamaika Mu

The executable Launcher.exe has been detected as malware by 28 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘STLauncher’. While running, it connects to the Internet address 155.ip-198-50-147.net on port 443.
Publisher:
Jamaika Mu

Product:
JMK Mu Launcher

Version:
0.15.0.463

MD5:
2025ffdaf3e1d79ea7686cb82896f5b3

SHA-1:
2bb56cfe79d26779ccbd866b50ffaa32c28b9d1d

Scanner detections:
28 / 68

Status:
Malware

Analysis date:
1/16/2025 11:12:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.253074
962

Agnitum Outpost
Worm.AutoRun
7.1.1

Avira AntiVirus
Worm/Autorun.bdep.1
7.11.153.220

Baidu Antivirus
Worm.Win32.AutoRun
4.0.3.14617

Bitdefender
Worm.Generic.253074
1.0.20.840

Bkav FE
W32.Clodb23.Trojan
1.3.0.4959

Clam AntiVirus
Win.Worm.Autorun-782
0.98/21155

Comodo Security
Worm.Win32.AutoRun.bdep
18468

Emsisoft Anti-Malware
Worm.Generic.253074
8.14.06.17.12

Fortinet FortiGate
W32/AutoRun.BDEP!worm
6/17/2014

F-Prot
W32/DelfInject.A.gen
v6.4.7.1.166

F-Secure
Worm.Generic.253074
11.2014-17-06_3

G Data
Worm.Generic.253074
14.6.24

IKARUS anti.virus
Worm.Win32.AutoRun
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.1712333

McAfee
Artemis!2025FFDAF3E1
5600.7096

MicroWorld eScan
Worm.Generic.253074
15.0.0.504

NANO AntiVirus
Trojan.Win32.AutoRun.uxexh
0.28.0.60100

Norman
AutoRun.BSKC
11.20140617

nProtect
Worm.Generic.253074
14.06.05.01

Panda Antivirus
W32/AutoRun.DJ.worm
14.06.17.12

Qihoo 360 Security
Win32/Worm.AutoRun.9f4
1.0.0.1015

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0EDD14
7.2.168

Trend Micro
TROJ_GEN.R0CBC0EDD14
10.465.17

Vba32 AntiVirus
Worm.AutoRun
3.12.26.0

VIPRE Antivirus
Worm.Win32.AutoRun
30056

ViRobot
Worm.Win32.Autorun.1131008
2011.4.7.4223

File size:
1.1 MB (1,131,008 bytes)

Product version:
no version

Copyright:
ZergNM & Jamaika Mu

Original file name:
Launcher.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
6/19/1992 5:52:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FVEA2nGYG7pzu5ymP9gU4ZUDefCYr9pyJH4c+G:F88xNkKpZtG

Entry address:
0xDBE50

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, B8, BA, 4D, 00, E8, 9F, AA, F2, FF, 8B, 1D, C4, F9, 4D, 00, 8B, 03, E8, 2E, DD, F9, FF, 8B, 03, BA, 10, BF, 4D, 00, E8, 1A, D9, F9, FF, 8B, 0D, A0, FA, 4D, 00, 8B, 03, 8B, 15, E0, 2D, 4D, 00, E8, 27, DD, F9, FF, 8B, 0D, E0, FA, 4D, 00, 8B, 03, 8B, 15, 0C, 5B, 4D, 00, E8, 14, DD, F9, FF, 8B, 0D, 38, FA, 4D, 00, 8B, 03, 8B, 15, 48, D1, 4B, 00, E8, 01, DD, F9, FF, 8B, 0D, 44, F7, 4D, 00, 8B, 03, 8B, 15, 04, CD, 4B, 00, E8, EE, DC, F9, FF, 8B, 0D, 6C, FA, 4D, 00, 8B, 03, 8B, 15...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
876 KB (897,024 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
STLauncher

Command:
C:\jamaikamu\launcher.exe


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP SSL):
Connects to 155.ip-198-50-147.net  (198.50.147.155:443)

Remove Launcher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.