home

outboat.exe

Shulan Hou

The application outboat.exe by Shulan Hou has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Protect Service(OutboatP)”. While running, it connects to the Internet address 125.235.4.59.adsl.viettel.vn on port 80 using the HTTP protocol.
Publisher:
Shulan Hou  (signed and verified)

MD5:
0136635bb48c7761bdcb1a19eeade4b8

SHA-1:
467509b249b5db190927e0ae3087dc59840200e9

SHA-256:
6444f911aa1c212dbd6589574196078d885c083bbe66f693c26ae81049d97954

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/28/2024 8:38:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ELEX (M)
16.8.9.10

File size:
445.9 KB (456,576 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\ProgramData\outboat\outboat.exe

Digital Signature
Signed by:
Shulan Hou

Authority:
thawte, Inc.

Valid from:
7/20/2016 6:00:00 AM

Valid to:
6/14/2017 5:59:59 AM

Subject:
CN=Shulan Hou, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
77C4983B630ECB2C08FBC858271E3D45

File PE Metadata
Compilation timestamp:
8/9/2016 7:38:03 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
6144:K71l68rUMixmW2zTB01VQp3SYZJx1w0PFmet1/g8PdAOT79jNmwUZYRPoykTC:K71ZmxXgZ71w0ttthPdLcYRPoykTC

Entry address:
0x2B15F

Entry point:
E8, D8, 07, 00, 00, E9, 80, FE, FF, FF, FF, 25, 60, F3, 44, 00, 8B, 4D, F4, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, F2, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 70, A0, 46, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, F2, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 70, A0, 46, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45...
 
[+]

Code size:
309 KB (316,416 bytes)

Service
Display name:
Protect Service(OutboatP)

Service name:
OutboatP

Description:
To ensure your Outboat software integrity. If this service is disabled or stopped, your Outboat software will not be kept integrity check. This service uninstalls itself when there is no Outboat softw

Type:
Win32OwnProcess

Depends on:
RpcSs


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to 125.235.4.59.adsl.viettel.vn  (125.235.4.59:80)

Remove outboat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.