home

revosetup.exe

VS Revo Group

The executable revosetup.exe has been detected as malware by 26 anti-virus scanners. The program is a setup application that uses the Nullsoft Scriptable Install System installer.
Publisher:
VS Revo Group  (signed and verified)

MD5:
655c4c4062fae779b6254aab5dad2494

SHA-1:
7a4ffc2061bec2535c8cfc2943de8676938e3b8a

SHA-256:
1b39ee03ecaa9a6b9a65c93dbaf0d6713384ea178706f6502cbdf5d63bdd8bf3

Scanner detections:
26 / 68

Status:
Malware

Analysis date:
11/23/2024 10:53:12 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win32/Slugin
2011.02.23

Avira AntiVirus
W32/Slugin.A
7.11.3.198

avast!
Win32:Patched-HO
2014.9-170227

AVG
Win32/Slugin.A
2018.0.2455

Bitdefender
Win32.SlugIn.A
1.0.20.290

Clam AntiVirus
Trojan.Spy-59563
0.98/17411

Comodo Security
TrojWare.Win32.Patched.P
7777

Dr.Web
Win32.Wplugin.1
9.0.1.058

ESET NOD32
Win32/Slugin
11.5898

Fortinet FortiGate
W32/Wplug.A
2/27/2017

F-Prot
W32/Slugin.B
v6.4.6.2.117

F-Secure
Win32.SlugIn.A
11.2017-27-02_2

IKARUS anti.virus
Trojan.Win32.Patched
t3scan.1.1.97.0

K7 AntiVirus
Trojan
13.88.3931

Kaspersky
Trojan.Win32.Patched
14.0.0.-1230

McAfee
W32/Wplugin
5600.6111

Microsoft Security Essentials
Virus:Win32/Slugin.A
1.163.1557.0

Norman
W32/Slugin.A
11.20170227

nProtect
Win32.SlugIn.A
11.02.10.01

Panda Antivirus
W32/Wplugin.A
17.02.27.01

Quick Heal
W32.Slugin.A
2.17.11.00

Sophos
W32/Slugin-A
4.61

Trend Micro House Call
PE_WPLUG.A
7.2.58

Trend Micro
PE_WPLUG.A
10.465.27

VIPRE Antivirus
Virus.Win32.Slugin.a
8510

ViRobot
Win32.Patched.N
2011.2.23.4324

File size:
1.1 MB (1,173,963 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Scriptable Install System

Digital Signature
Signed by:
VS Revo Group

Authority:
VeriSign, Inc.

Valid from:
12/19/2008 7:00:00 AM

Valid to:
12/20/2009 6:59:59 AM

Subject:
CN=VS Revo Group, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=VS Revo Group, L=Ruse, S=Ruse, C=BG

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5BE03D48E6CEA58DCA99AFD3EDAE4CCC

File PE Metadata
Compilation timestamp:
2/22/2009 2:46:29 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x30CB

Entry point:
60, E8, 00, 00, 00, 00, 5B, 81, EB, D0, 48, 00, 10, 83, EC, 74, 8B, EC, 8B, 83, AB, 4B, 00, 10, 89, 45, 00, 8B, 83, B3, 4B, 00, 10, 03, 45, 00, 89, 45, 2C, 8B, 83, B7, 4B, 00, 10, 03, 45, 00, 89, 45, 30, C7, 45, 14, 00, 00, 00, 00, C7, 45, 18, 00, 00, 00, 00, C7, 45, 1C, 00, 00, 00, 00, 8B, 45, 14, FF, 45, 14, 66, 33, C9, 8A, 8C, 03, FF, 4B, 00, 10, 84, C9, 74, 7A, 8B, 45, 1C, 66, 01, 4D, 1C, 03, C3, 05, 13, 4C, 00, 10, 50, 8B, 45, 2C, FF, 10, 85, C0, 0F, 84, 5E, 02, 00, 00, 89, 45, 10, 8B, 45, 1C, 03, C3...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
22.5 KB (23,040 bytes)

Remove revosetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.