home

RemoveWAT.exe

RemoveWAT

Hazar & Co.

The executable RemoveWAT.exe has been detected as malware by 1 anti-virus scanner. This is a setup program which is used to install the application. The file has been seen being downloaded from online.b1.org and multiple other hosts.
Publisher:
Hazar & Co.

Product:
RemoveWAT

Version:
2.2.5.0

MD5:
49806ed3a01ffe6765f0b6ba1289d97e

SHA-1:
b14f71e125aa19f2a5e1a2de08a2738901fa2683

SHA-256:
fcae67041366cb88ecd36dc848a13f0a40e9ba55869c2fd3ffef6449e6d63e25

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/5/2024 7:34:16 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Unnamed.Threat.43
14.3.26.5

File size:
6.4 MB (6,663,168 bytes)

Product version:
2.2.5.0

Copyright:
Copyright Hazar & Co. © 2010

Original file name:
RemoveWAT.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
2/27/2010 1:13:30 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
98304:D33yKMaL/eXV1i/kDxkmcL/eXV1i/kaRWYL/eXV1i/kmeM1qj4iwiANvSo2/CAy4:byKnZrrLGA3PhsKPkG09W8

Entry address:
0x64337E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
6.3 MB (6,558,720 bytes)

The file RemoveWAT.exe has been seen being distributed by the following 12 URLs.

http://online.b1.org/rest/online/download/RemoveWAT2.2.5_janrock.rar/.../RemoveWAT 2.2.5.exe

http://dc128.4shared.com/download/.../removewat.exe

temp:RemoveWAT.exe

http://dc368.4shared.com/download/.../remove_wat.exe

http://dc368.4shared.com/download/.../removewat.exe

https://doc-0k-80-docs.googleusercontent.com/docs/securesc/ciekls4n46vjpvfujj2u5c1sjhhl17r6/fhbmratehnit5t4uqveko6l5r4c6hb3m/1464386400000/17099168028074459833/.../0B4AkIUNO1oYxZlNrRENtMU54TEU?e=download

http://dc667.4shared.com/download/.../removewat.exe

http://u.poczta.o2.pl/?cmd=getpart&link=unuMAAk9unQyhOdeSAtPzbaOTOAa2OtLTPwNjN6hWaZjSMeP3OxPTPRcjNwPDNZhnYwjjNRczMocDOJ83bwjTOoNDOkODMJ8jNZjTMJ8DbadiNs8CMskwAikHA3FGdpJWaf7GIf7HI3FmbodmLUeQZk

http://download1968.mediafire.com/eenbgob76ebg/.../RemoveWAT.exe

https://doc-00-4c-docsviewer.googleusercontent.com/viewer/securedownload/61luln50s1hc3qla32b68etf2b71igh5/7tlagnbeasjsivh0qk9846gm33ubbns0/1395248400000/ZXhwbG9yZXI=/.../MEIwZ2VlOG9ydkRVMVlUa3pPREkxTURndE5XTTJaUzAwTTJVeExUZzJNekV0T1dNNE5UVXpPV0ZqTmpWbQ==?sec=AHSqidacEmvkFpWGPe5x8vfCYVnN2wgvKrEL1hgsPt27905YCCvDn47vJ1kAjL9tWLTaOaj-OkPf&a=dl&filename=RemoveWAT22_2.zip&rel=zip;z1;RemoveWAT.exe&nonce=3vs72e8tcb05s&user=AGZ5hq96_QtyJBzE-q1K4A3cRVJX&hash=qvsi2roke4ipchkohknq9l1ed1ljnc93

https://docs.google.com/viewer/noncesigner?nonce=3vs72e8tcb05s&continue=https://doc-00-4c-docsviewer.googleusercontent.com/viewer/securedownload/61luln50s1hc3qla32b68etf2b71igh5/7tlagnbeasjsivh0qk9846gm33ubbns0/1395248400000/ZXhwbG9yZXI=/.../MEIwZ2VlOG9ydkRVMVlUa3pPREkxTURndE5XTTJaUzAwTTJVeExUZzJNekV0T1dNNE5UVXpPV0ZqTmpWbQ==?sec=AHSqidacEmvkFpWGPe5x8vfCYVnN2wgvKrEL1hgsPt27905YCCvDn47vJ1kAjL9tWLTaOaj-OkPf&a=dl&filename=RemoveWAT22_2.zip&rel=zip;z1;RemoveWAT.exe&hash=8j8llbcvp2m4naeqhlvnktigq10sdtjg

https://doc-00-4c-docsviewer.googleusercontent.com/viewer/securedownload/61luln50s1hc3qla32b68etf2b71igh5/7tlagnbeasjsivh0qk9846gm33ubbns0/1395248400000/ZXhwbG9yZXI=/.../MEIwZ2VlOG9ydkRVMVlUa3pPREkxTURndE5XTTJaUzAwTTJVeExUZzJNekV0T1dNNE5UVXpPV0ZqTmpWbQ==?a=dl&filename=RemoveWAT22_2.zip&sec=AHSqidacEmvkFpWGPe5x8vfCYVnN2wgvKrEL1hgsPt27905YCCvDn47vJ1kAjL9tWLTaOaj-OkPf&rel=zip;z1;RemoveWAT.exe

Remove RemoveWAT.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.