home

registryquick_setup.exe

My Company, Inc.

The application registryquick_setup.exe, “ReQuick Setup ” has been detected as a potentially unwanted program by 35 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.registryquick.net.
Publisher:
My Company, Inc.

Description:
ReQuick Setup

MD5:
89c28fe18046e3ddf69e0077cc12a6b9

SHA-1:
3dddae1f34ac4293b27d97d7aa181ac8d15b8323

SHA-256:
e67510b098c3c86800859a794d20827ed0a9a0ad05aff7f68bf0f123691428ae

Scanner detections:
35 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/27/2024 6:37:53 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
5744357

Agnitum Outpost
Win32.Sality.BL
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2015.10.21

Avira AntiVirus
W32/Sality.AT
7.11.30.172

avast!
Win32:SaliCode
151019-2

AVG
Win32/Sality
2015.0.4435

Baidu Antivirus
Virus.Win32.Sality.$Emu
4.0.3.151021

Bitdefender
Win32.Sality.3
1.0.20.1470

Bkav FE
W32.Sality.PE
1.3.0.7237

Comodo Security
Virus.Win32.Sality.gen
23452

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.14.151

G Data
Win32.Sality
15.10.25

IKARUS anti.virus
Virus.Sality
t3scan.1.9.5.0

K7 AntiVirus
Virus
13.211.17595

Kaspersky
Virus.Win32.Sality
15.0.0.463

McAfee
Program.Artemis!D952CBD99FEA
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.207.3491.0

MicroWorld eScan
Win32.Sality.3
16.0.0.882

NANO AntiVirus
Virus.Win32.Sality.beygb
0.30.26.3947

Norman
Win32.Sality.3
10.10.2015 03:41:45

nProtect
Virus/W32.Sality.D
15.10.20.01

Panda Antivirus
W32/Sality.AA
15.10.21.12

Quick Heal
W32.Sality.U
10.15.14.00

Rising Antivirus
PE:Virus.Sality!1.A09C[F1]
23.00.65.151019

Sophos
Virus 'Mal/Sality-D'
5.15

Total Defense
Win32/Sality.AA
37.1.62.1

Trend Micro House Call
PE_SALITY.RL
7.2.294

Trend Micro
PE_SALITY.RL
10.465.21

Vba32 AntiVirus
Virus.Win32.Sality.bakc
3.12.26.4

VIPRE Antivirus
Threat.4721115
43798

ViRobot
Win32.Sality.Gen.A[h]
2014.3.20.0

File size:
1.2 MB (1,302,874 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\registryquick_setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0KHNJAzlMJmqCyCY0fqvgvWp9N1JyoDecvFnwzEt/WcesONI5EeYw:bJAxMJ/CyCzCY+p9N3yCeMnScT0ez

Entry address:
0x922C

Entry point:
00, D5, 8D, 3D, B7, 12, E8, 03, 87, F2, 0F, AF, EB, 12, F0, 0F, BF, C9, 56, B4, 81, 8A, D2, E8, 00, 00, 00, 00, BB, 77, AC, FF, 05, 88, F0, C7, C1, B8, B5, 96, C6, C6, C6, E5, F3, 81, FF, CE, CA, 00, 00, 5D, 86, D2, 86, E4, 57, 57, 3A, F7, 81, DE, 05, 77, 0B, 5D, C7, C0, BE, 1F, 3D, 68, F7, C3, 59, C5, F6, 55, 14, 48, 10, D8, F2, 0F, BE, F8, 0F, B7, C0, 33, DB, 87, C6, 0F, AF, C7, F7, C6, EA, 55, ED, 14, F2, F3, FE, C4, 81, C3, 5B, FF, FF, FF, FE, C6, 20, D5, 81, C3, A6, 00, 00, 00, 85, C5, 69, F1, FD, E8...
 
[+]

Code size:
34.5 KB (35,328 bytes)

The file registryquick_setup.exe has been seen being distributed by the following URL.

http://www.registryquick.net/.../RegistryQuick_setup.exe

Remove registryquick_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.