home

registryquick_setup.exe

My Company, Inc.

The application registryquick_setup.exe, “ReQuick Setup ” has been detected as a potentially unwanted program by 33 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.registryquick.net.
Publisher:
My Company, Inc.

Description:
ReQuick Setup

MD5:
ebe57b5e44d1650480286956f260c751

SHA-1:
128c4aa46f83ae918ee3545dbf867f8c459be266

SHA-256:
74aa0d7085b92ca4e840aaefcc8d0ad46d7565e9d838cc805fa1c1ed1d9a1537

Scanner detections:
33 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
1/14/2025 8:37:39 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
5744866

Agnitum Outpost
Win32.Sality.BL
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2015.10.21

Avira AntiVirus
W32/Sality.AT
7.11.30.172

Arcabit
Win32.Sality.3
1.0.0.585

avast!
Win32:SaliCode
150913-1

AVG
Win32/Sality
2015.0.4435

Bitdefender
Win32.Sality.3
1.0.20.1470

Comodo Security
Virus.Win32.Sality.gen
23452

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.14.151

G Data
Win32.Sality
15.10.25

IKARUS anti.virus
Virus.Sality
t3scan.1.9.5.0

K7 AntiVirus
Virus
13.211.17595

Kaspersky
Virus.Win32.Sality
15.0.0.463

McAfee
Program.Artemis!D952CBD99FEA
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.207.3491.0

MicroWorld eScan
Win32.Sality.3
16.0.0.882

NANO AntiVirus
Virus.Win32.Sality.beygb
0.30.26.3947

nProtect
Virus/W32.Sality.D
15.10.20.01

Panda Antivirus
W32/Sality.AA
15.10.21.12

Quick Heal
W32.Sality.U
10.15.14.00

Rising Antivirus
PE:Virus.Sality!1.A09C[F1]
23.00.65.151019

Sophos
Virus 'Mal/Sality-D'
5.15

Total Defense
Win32/Sality.AA
37.1.62.1

Trend Micro House Call
PE_SALITY.RL
7.2.294

Trend Micro
PE_SALITY.RL
10.465.21

Vba32 AntiVirus
Virus.Win32.Sality.bakc
3.12.26.4

VIPRE Antivirus
Threat.4721115
43798

ViRobot
Win32.Sality.Gen.A[h]
2014.3.20.0

File size:
1.2 MB (1,290,586 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\registryquick_setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:iZAzlMJmqCyCY0fqvgvWp9N1JyoDecvFnwzEt/WcesONI5EeYw:kAxMJ/CyCzCY+p9N3yCeMnScT0ez

Entry address:
0x922C

Entry point:
0F, B6, DF, 69, F9, AF, 70, E3, 17, 0F, B6, FF, 68, A5, BE, 1E, 00, 69, DF, B5, 08, 6D, 0F, 85, F8, 81, E2, A1, 70, 43, 2D, 85, E8, EB, 08, 8A, F5, 69, DE, FA, D9, ED, 9B, 69, FD, A5, 16, 25, E3, 87, D1, 85, C6, E8, 18, 00, 00, 00, 1C, E2, 22, F4, 89, C6, C6, C6, DE, 4A, 81, EB, 1A, 09, F1, FF, 84, EA, 81, EB, 2A, A4, 0F, 00, 70, 05, 84, DD, 0F, AF, C1, 23, C3, 87, D5, 4D, 0F, B7, F3, 34, 8A, BB, 76, 97, 00, 00, 76, 0D, F7, C5, A0, AC, 01, A0, 85, CD, 1D, 0F, 71, 3F, DA, 81, F3, 51, 9C, 00, 00, 46, 80, C1...
 
[+]

Code size:
34.5 KB (35,328 bytes)

The file registryquick_setup.exe has been seen being distributed by the following URL.

http://www.registryquick.net/.../RegistryQuick_setup.exe

Remove registryquick_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.