home

mustang.exe

Mustang Browser

RAFO TECHNOLOGY INC

The application mustang.exe by RAFO TECHNOLOGY INC has been detected as a potentially unwanted program by 2 anti-malware scanners. While running, it connects to the Internet address upload-lb.esams.wikimedia.org on port 443.
Publisher:
Rafotech  (signed by RAFO TECHNOLOGY INC)

Product:
Mustang Browser

Version:
1.0.39.99

MD5:
14500fec0932fee56ca8d207afadc71f

SHA-1:
bc91b53e6476d1846a5ba449220d371748cf680e

SHA-256:
e64a576b5a5d4a255f718c76c6c7585b0f4606c2f20c38fb6bf80f4aa50ade87

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 7:51:20 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.RafoTech (M)
16.11.15.13

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.4

File size:
667.1 KB (683,096 bytes)

Product version:
1.0.39.99

Copyright:
Copyright 2015 Rafotech. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\mustang browser\mustang\mustang.exe

Digital Signature
Signed by:
RAFO TECHNOLOGY INC

Authority:
GlobalSign nv-sa

Valid from:
3/18/2015 5:50:02 AM

Valid to:
3/18/2016 5:50:02 AM

Subject:
CN=RAFO TECHNOLOGY INC, O=RAFO TECHNOLOGY INC, L=Alhambra, S=California, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130B87F4F087E63E0D3D6DC5F093C0729

File PE Metadata
Compilation timestamp:
4/9/2015 5:05:05 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:zwiL8WN0ck9upVnMMRjlPUZTpi/vdQkhcbG3rkqQAA1BQZmGY2uZGMmEPMQ:zwiDpjlQi/RhcbG3rkLuZpsEQ

Entry address:
0x3EFD4

Entry point:
E8, 2B, D0, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 8B, 45, 08, 99, F7, 7D, 0C, 5D, C3, CC, CC, CC, CC, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, 55, 8B, EC, FF, 75, 14, 6A, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 05, 00, 00, 00, 83, C4, 14, 5D, C3, 55, 8B, EC, 83, EC, 20, 53, 57, 33, DB, 8D, 7D, E4, 6A, 07, 33, C0, 89, 5D, E0, 59...
 
[+]

Entropy:
6.2851

Code size:
362 KB (370,688 bytes)

Shell Open Command
Open type:
ftp

Command:
"C:\Program Files\mustang browser\mustang\mustang.exe" -- "%1"


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to bi.gazeta.pl  (80.252.0.134:80)

TCP (HTTP SSL):
Connects to text-lb.esams.wikimedia.org  (91.198.174.192:443)

TCP (HTTP SSL):
Connects to upload-lb.esams.wikimedia.org  (91.198.174.208:443)

TCP (HTTP SSL):
Connects to static.interia.pl  (217.74.71.132:443)

TCP (HTTP SSL):
Connects to rtax.criteo.com  (178.250.2.100:443)

TCP (HTTP SSL):
Connects to hlbf.interia.pl  (217.74.71.147:443)

TCP (HTTP SSL):
Connects to interia.hit.gemius.pl  (217.74.74.29:443)

TCP (HTTP SSL):
Connects to hzn-620337.hardns.net  (88.99.68.67:443)

TCP (HTTP SSL):
Connects to hub.com.pl  (217.74.74.30:443)

TCP (HTTP SSL):
Connects to host-80-252-0-235.gazeta.pl  (80.252.0.235:443)

TCP (HTTP SSL):
Connects to edge-star-mini-shv-01-frt3.facebook.com  (31.13.92.36:443)

TCP (HTTP):
Connects to filmweb.pl  (193.200.227.13:80)

TCP (HTTP):
Connects to a92-123-224-106.deploy.akamaitechnologies.com  (92.123.224.106:80)

TCP (HTTP):
Connects to a104-89-31-53.deploy.static.akamaitechnologies.com  (104.89.31.53:80)

TCP (HTTP):
Connects to a104-86-54-58.deploy.static.akamaitechnologies.com  (104.86.54.58:80)

TCP (HTTP):
Connects to dmppixel-shared-mtc-c.evip.aol.com  (64.12.245.38:80)

Remove mustang.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.