home

mhost.exe

The executable mhost.exe has been detected as malware by 26 anti-virus scanners. This is a setup program which is used to install the application. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘svc’. Accoriding to the detections, this has been classified as a kyelogger which is capable of recoring a user's keystrokes. The file has been seen being downloaded from down.eoo.cm.
MD5:
92b1448f243772377859f00fdd275ae8

SHA-1:
529c59558e6967b27b4560b0b9c7a876e0a78b90

SHA-256:
0dcb6f8e934785bbc121ca9e6514302f6499c9933579eed458218831955dcaf7

Scanner detections:
26 / 68

Status:
Malware

Analysis date:
11/24/2024 8:27:01 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Generic.Malware.FP!V!PkTkg.E9B4733C
350

Agnitum Outpost
Trojan.Agent
7.1.1

AhnLab V3 Security
Backdoor/Win32.Zegost
2016.02.20

Avira AntiVirus
BDS/Farfli.208908
8.3.3.2

Arcabit
Generic.Malware.FP!V!PkTkg.E9B4733C
1.0.0.653

avast!
Win32:Farfli-AV [Trj]
2014.9-160219

AVG
BackDoor.Generic_r
2017.0.2828

Bitdefender
Generic.Malware.FP!V!PkTkg.E9B4733C
1.0.20.250

Comodo Security
TrojWare.Win32.Magania.~AAD
24261

Dr.Web
Trojan.KeyLogger.37279
9.0.1.050

Emsisoft Anti-Malware
Generic.Malware.FP!V!PkTkg.E9B4733C
8.16.02.19.08

ESET NOD32
Win32/Farfli.AFJ (variant)
10.13056

F-Prot
W32/KillAV.AU.gen
v6.4.7.1.166

F-Secure
Generic.Malware.FP!V!PkTkg.E9B4733C
11.2016-19-02_6

G Data
Generic.Malware.FP!V!PkTkg.E9B4733C
16.2.25

IKARUS anti.virus
Backdoor.Win32.Caphaw
t3scan.2.0.7.0

K7 AntiVirus
Trojan
13.213.18804

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.636

Microsoft Security Essentials
Backdoor:Win32/Zegost.BZ
1.1.12400.0

MicroWorld eScan
Generic.Malware.FP!V!PkTkg.E9B4733C
17.0.0.150

NANO AntiVirus
Trojan.Win32.Farfli.dzgczd
1.0.14.6204

Qihoo 360 Security
QVM07.1.Malware.Gen
1.0.0.1120

Quick Heal
Backdoor.Zegost.BZ4
2.16.14.00

Rising Antivirus
PE:Backdoor.Farfli!1.64D7 [F]
23.00.65.16217

Vba32 AntiVirus
BScope.Trojan.SvcHorse.01643
3.12.26.4

VIPRE Antivirus
BehavesLike.Win32.Malware.rwx (mx-v)
47326

File size:
204 KB (208,911 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\mhost.exe

File PE Metadata
Compilation timestamp:
12/12/2015 9:47:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:aLg4taJZOWnpMVb536aj85Z+ubQuI1y3BlCsiEk1eL9txReCCKB:WgcaJNeKajcVkBy3BsdMBRVCKB

Entry address:
0x1C128

Entry point:
55, 8B, EC, 6A, FF, 68, 08, 63, 42, 00, 68, D8, AF, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, 8C, 51, 42, 00, 33, D2, 8A, D4, 89, 15, 28, 4A, 43, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 24, 4A, 43, 00, C1, E1, 08, 03, CA, 89, 0D, 20, 4A, 43, 00, C1, E8, 10, A3, 1C, 4A, 43, 00, 6A, 01, E8, 22, 1D, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C3, 00, 00, 00, 59, E8, B4, 0B, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B2, 00, 00, 00, 59, 33, F6, 89, 75...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
144 KB (147,456 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
svc

Command:
C:\users\{user}\appdata\local\temp\mhost.exe


The file mhost.exe has been seen being distributed by the following URL.

http://down.eoo.cm/mhost.exe

Remove mhost.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.