lgytnw.exe

The executable lgytnw.exe has been detected as malware by 6 anti-virus scanners. The file has been seen being downloaded from a.pomf.cat.
MD5:
5adb6f962885886fb80f0f2a26b1b631

SHA-1:
4075dd2d8f4503fd41a811662fb1e1143d9f68a6

SHA-256:
9d052fecf3be772bc1acc1d97d45159047b88c70e0f0fb05d10988a432868330

Scanner detections:
6 / 68

Status:
Malware

Analysis date:
11/27/2024 8:49:20 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
MSIL:GenMalicious-ETE [Trj]
160414-2

Dr.Web
Trojan.Nanocore.23
9.0.1.05190

Emsisoft Anti-Malware
Backdoor.MSIL.Agent.GD
11.5.0.6191

ESET NOD32
MSIL/NanoCore.E trojan
8.0.319.0

Microsoft Security Essentials
Threat.Undefined
1.225.1028.0

Norman
Backdoor.MSIL.Agent.GD
28.05.2016 15:32:18

File size:
202.5 KB (207,360 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\lgytnw.exe

File PE Metadata
Compilation timestamp:
2/22/2015 2:49:37 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:gLV6Bta6dtJmakIM59jaSdHlHMLHLpnN55:gLV6Btpmky3FmHLpnN55

Entry address:
0x1E792

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, E0, 01, 00, 0C, 00, 00, 00, 94, 37, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.4471

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
114 KB (116,736 bytes)

The file lgytnw.exe has been seen being distributed by the following URL.

Remove lgytnw.exe - Powered by Reason Core Security