home

mustang_setup_landpage_a7a4ab61-8fd1-f2c4-2316-c26d1a8c9d89_1.0.exe

Mustang Browser

RAFO TECHNOLOGY INC

The application mustang_setup_landpage_a7a4ab61-8fd1-f2c4-2316-c26d1a8c9d89_1.0.exe by RAFO TECHNOLOGY INC has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from download.rafotech.com and multiple other hosts.
Publisher:
Rafotech  (signed by RAFO TECHNOLOGY INC)

Product:
Mustang Browser

Version:
1.44.46.6

MD5:
bd00d266be9bba2a94b801698c926340

SHA-1:
5b4d858a56a8e7411f1bb73b4db27b42c0f634ab

SHA-256:
9ad2af9ff5fb6a5a9202a96011931953d6949f1f57c666af0c10aa4428e61667

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 12:53:20 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Fafo.MB (M)
16.11.10.14

File size:
668.6 KB (684,632 bytes)

Product version:
1.44.46.6

Copyright:
Copyright 2015 Rafotech. All rights reserved

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\Pictures\mustang_setup_landpage_a7a4ab61-8fd1-f2c4-2316-c26d1a8c9d89_1.0.exe

Digital Signature
Signed by:
RAFO TECHNOLOGY INC

Authority:
GlobalSign nv-sa

Valid from:
3/18/2015 12:50:02 AM

Valid to:
3/18/2016 12:50:02 AM

Subject:
CN=RAFO TECHNOLOGY INC, O=RAFO TECHNOLOGY INC, L=Alhambra, S=California, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130B87F4F087E63E0D3D6DC5F093C0729

File PE Metadata
Compilation timestamp:
8/22/2015 5:32:46 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:FHFbZXRUmna07b4rT9N2ct88zt9hjBZFx5V9zydSiezsm2KtYg6IL4oz09qbZhS1:TZRpPyTFF7hdDaSiNK3/LumuSkkwtr

Entry address:
0x1FA76

Entry point:
E8, 7B, 92, 00, 00, E9, 7F, FE, FF, FF, E8, 31, 76, 00, 00, 85, C0, 75, 06, B8, D4, 31, 44, 00, C3, 83, C0, 0C, C3, 55, 8B, EC, 56, E8, E4, FF, FF, FF, 8B, 4D, 08, 51, 89, 08, E8, 20, 00, 00, 00, 59, 8B, F0, E8, 05, 00, 00, 00, 89, 30, 5E, 5D, C3, E8, FD, 75, 00, 00, 85, C0, 75, 06, B8, D0, 31, 44, 00, C3, 83, C0, 08, C3, 55, 8B, EC, 8B, 4D, 08, 33, C0, 3B, 0C, C5, 68, 30, 44, 00, 74, 27, 40, 83, F8, 2D, 72, F1, 8D, 41, ED, 83, F8, 11, 77, 05, 6A, 0D, 58, 5D, C3, 8D, 81, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8...
 
[+]

Entropy:
6.7458

Code size:
202.5 KB (207,360 bytes)

The file mustang_setup_landpage_a7a4ab61-8fd1-f2c4-2316-c26d1a8c9d89_1.0.exe has been seen being distributed by the following 9 URLs.

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=21BAE9E4-FA80-DEB1-B62D-F34AD44E7316&guid=93c1d76c-b7c2-81f5-b4ec-5a782a167fd6

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=055274E8-18AD-4616-EBA4-7374B8240F11&guid=2751720d-acce-fa0-1430-c9cfe5112597

http://browserss.ru/.../mustang_browser_1.44.46.6.exe

http://mustangbrowser.softonic.com.br/download-tracker?th=1/.../jh2KoIkwd6MWFdMHTqMWwNzt3irJLFAplkt1kjxpZflby9wvhHQ06xBC75FR3inLZ5B0w TZXdxSFy7RMMkSIU6gp5pRfA==

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=359A47BC-254C-718E-921E-DE71EB8F3A16&guid=bab79e74-aa2-7fcf-e98f-7b27243394fc

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=1D306F7A-4852-C9A4-8DDA-F1CFAE3465F3&guid=d99a76dd-6963-7d1e-c941-8c082abc4b

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=0A52309D-15F6-5305-8439-921539312C17&guid=67fecff1-d687-4fca-de06-b0a9a1de9f40

http://download.rafotech.com/.../download.php?cid=bxk

http://download.rafotech.com/.../download.php?cid=landpage&s2sid=C4491C21-4A87-E65F-C4A9-0BA2E0B63318&guid=6bf2154d-5b68-3791-5ff2-511388ff3481

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.