home

re-loaderbyr@1n.exe

Re-Loader By R@1n

The application re-loaderbyr@1n.exe has been detected as a potentially unwanted program by 16 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s8354.chomikuj.pl and multiple other hosts.
Product:
Re-Loader By R@1n

Description:
Activator

Version:
2.0.1.0

MD5:
3f9e92c675e4cf601fcf71004c758fd6

SHA-1:
45f1fc3580da9eb3697367dcd3589020ed1744f5

SHA-256:
2ebf5bc53182610095c891b7288faf2202682a58b95ad6274fecea9834d049e3

Scanner detections:
16 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 1:33:11 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2861305
419

Arcabit
Trojan.Generic.D2BA8F9
1.0.0.628

avast!
PUP-gen [PUP]
151024-0

Baidu Antivirus
Hacktool.Win32.Wpakill
4.0.3.151212

Bitdefender
Trojan.GenericKD.2861305
1.0.20.1730

Emsisoft Anti-Malware
Trojan.GenericKD.2861305
8.15.12.12.03

F-Secure
Trojan.GenericKD.2861305
11.2015-12-12_7

G Data
MSIL.Riskware.Hacktool
15.11.25

K7 AntiVirus
Riskware
13.212.18035

McAfee
Artemis!3F9E92C675E4
5600.6553

Microsoft Security Essentials
HackTool:Win32/Wpakill
1.1.12300.0

MicroWorld eScan
Trojan.GenericKD.2861305
16.0.0.1038

nProtect
Trojan.GenericKD.2861305
15.12.08.01

Panda Antivirus
Trj/CI.A
15.12.12.03

Sophos
Generic PUA EF (PUA)
4.98

VIPRE Antivirus
Potentially Unwanted Application (PUA) (not malicious)
45692

File size:
1.9 MB (2,041,202 bytes)

Product version:
2.0.1.0

Copyright:
Copyright © By R@1n 2015

Original file name:
Activator.exe

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
12/9/2010 9:58:13 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:CJCoU1Qbb9oJ9AX83TbeZz+0xxb0V++gXgEjIIxF+XqUHFRDc13G9nwrfMB8y7Fn:CtUyo9/3Tbiz+r8wCtUHM13Gxwgn

Entry address:
0x2E5E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
4 KB (4,096 bytes)

The file re-loaderbyr@1n.exe has been seen being distributed by the following 12 URLs.

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBslE5TcWG_dRUDeJklldBWjK4sIDcdQv58lmOOLJWe5Kb6hImErj5OylgMA5v-rSvYTzJ2sysRH8xYXT9Ad8m3GaiidQnrusSOnOsF1up8l21k7ZZXzjSUIWJK47WD9xwU&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBuQC2Y50o2EH3hP7zN3rkAtVK6IqKGZEd5E7IniklmAiEhiD-SOp0zz380c4cb82cjZReJZ0vsiy9FXTrJPt4ooDvLAQlENpyuBMh4O2EEM3Eev765vxF3nKCzQxmrAMV0&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBseKE8cAisjIzwuESn7Kp-eD4xukWplNm_x4OrI8v-9JAIanN5rrjRIqVZXceM0NWDQSVpf1jmQ7iBkyKV9hX0xRWRWFD2YvKNeZSl1P4rruj5vTPe_cuCJeSWx8uqe2vo&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBs6EdcuJwcITzmdRzB1GpvthLAfUh4EsShsYElFavNLTW4GZ7Q6XqYmGnVi8ynrub0AIBZUUxYVI2622-Don5QhvUEkvuxvBv_H2Y2D-pyISmpOrRi_iGpui3EdC1gzXJI&pv=2

https://revclouds.com/n3ei3bw7gl3h

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBsf0HEG2HUDh_FBk3iqIiyCDHI7eiJlFJDSBLnkQVCqRju3B5iZo4MMV0UocIJ5GV166G-gweLiBth_WD5S3iYtL_nlA9RBfE7AapJRUh3WaysgfzpEs85IfLurtwQGbAU&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBualVdy83yRM96qwlcYHluGnrHgB0sFIsr3ZvGYDVe_TJYm6L_zz1AbiqUbzi01Jis8kRQwOdBT8XaMW29NY7cX7wrSjAV-xS2V5bCMVm4fNZAV6v70WmuoA89nLDp9EbU&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBuQqpm13vUpc8qlS9bIc6vHUjEeB3KHUQoh7GGVoI2CQb8dVg4cF7xaMQXs3B7xEd1MSE-rNzJ8FzgAFznxpbDcByleXn5jbmpBqQUq1P15DS6g_68QIRxdXzZXZ6OLkng&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBthUEfKVoexaNmLFlQ192VzDvKjAeYhtooSxg3SGwM-yErdFAOrcpbNQkXuwb2FEhISlJPlDWi5cOyg_xO2q0REuby3u2lyU-dXpRMkoNlEEOzwUUih3Nxzx9dHbwNOpxo&pv=2

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBtlmni8ae_ClXRxyjaqJtej9vuhq6jYAXRTxyKjQHOpMk5VoITJF-_k3Q87Zxn58L8uRqYJ1aNShc8Zh9HMYyekdVlQulrLJFPfMaOb98QZfW9VeoirlBwBubZAK-0hRk0&pv=2

https://dailyuploads.net/d0ow4or71gie

http://s8354.chomikuj.pl/File.aspx?e=uJU9zvWZTOb4bstNxH2RRLBDyFPbp8RAVAaTuDjkJBuinVONtNZf-TujY9famBJ_d48CtdyIJIxPDG_GIeJiL6x-kQCH4hYytEnMeL4jAUCqau8H-Ue9bIsjVHYhcKgNc6_knOmYB72VSu2iK743N6SRt9G7lVDdRSVDjAfZr8A&pv=2

Remove re-loaderbyr@1n.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.