home

lyrxoapgly.exe

Qt Designer

Digia Plc and/or its subsidiary(-ies)

The executable lyrxoapgly.exe has been detected as malware by 10 anti-virus scanners. This is a setup program which is used to install the application. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Microsoft Windows Manager’. The file has been seen being downloaded from evaporez.com.
Publisher:
Digia Plc and/or its subsidiary(-ies)

Product:
Qt Designer

Version:
1.0.0.0

MD5:
be698ec895b9135fd0444537353583ad

SHA-1:
fe3fcc1ffa774c12f99762871976ee64006281a8

Scanner detections:
10 / 68

Status:
Malware

Analysis date:
11/5/2024 1:49:56 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-151107

AVG
Inject3
2016.0.2933

Baidu Antivirus
Backdoor.Win32.Androm
4.0.3.15117

Dr.Web
Trojan.PWS.Siggen1.41536
9.0.1.0311

ESET NOD32
Win32/Injector.CLWY (variant)
9.12529

K7 AntiVirus
Trojan
13.212.17780

Kaspersky
Backdoor.Win32.Androm
14.0.0.1158

Malwarebytes
Backdoor.IRCBot
v2015.11.07.10

NANO AntiVirus
Trojan.Win32.Androm.dymkky
0.30.26.4437

Qihoo 360 Security
QVM05.1.Malware.Gen
1.0.0.1077

File size:
847.5 KB (867,840 bytes)

Product version:
1.0.0.0

Copyright:
Copyright (C) 2015 The Qt Company Ltd.

Original file name:
designer.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\Local settings\temp\lyrxoapgly.exe

File PE Metadata
Compilation timestamp:
2/19/2014 4:28:36 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3+x9BZJTxEox9OxYwHMmW0GO7vPiY0tP890:md/xupktL

Entry address:
0xA9520

Entry point:
55, 8B, EC, 83, C4, F0, B8, 90, 92, 4A, 00, E8, 4C, D7, F5, FF, A1, B4, 1B, 4B, 00, 8B, 00, E8, 7C, 18, FB, FF, 8B, 0D, 34, 1D, 4B, 00, A1, B4, 1B, 4B, 00, 8B, 00, 8B, 15, B8, 89, 4A, 00, E8, 7C, 18, FB, FF, A1, B4, 1B, 4B, 00, 8B, 00, E8, F0, 18, FB, FF, E8, 77, AF, F5, FF, 8D, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
673.5 KB (689,664 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Microsoft Windows Manager

Command:
C:\windows\m-5050450368024056545040250450525\winmgr.exe


The file lyrxoapgly.exe has been seen being distributed by the following URL.

http://evaporez.com/trk.exe

Remove lyrxoapgly.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.