home

roguekillerx64.exe

This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from mirror10.fosshub.com and multiple other hosts.
MD5:
be347c01bacde1ea98a5cd8425869961

SHA-1:
ba02fe66121d9e332d6861139018ce135c966049

SHA-256:
ea511f7e889af882836c8f2853662a793841b2bf9418eccc8d41e1bee122716f

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/4/2024 4:58:14 PM UTC  (today)

File size:
14.2 MB (14,884,668 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\roguekillerx64.exe

File PE Metadata
Compilation timestamp:
10/16/2014 12:29:14 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
393216:rGlJw12l1KEo5ixtKLr7YwoIptAZH9li82aK/aMDgQ/SUTM8wA0eFJsv6tWKFdus:gl1uMK

Entry address:
0x76BEE4

Entry point:
48, 83, EC, 28, E8, 63, 0D, 01, 00, 48, 83, C4, 28, E9, 52, FE, FF, FF, CC, CC, 48, 85, C9, 74, 37, 53, 48, 83, EC, 20, 4C, 8B, C1, 48, 8B, 0D, 8C, D1, 71, 00, 33, D2, FF, 15, B4, F9, 17, 00, 85, C0, 75, 17, E8, 43, 1B, 00, 00, 48, 8B, D8, FF, 15, 82, F6, 17, 00, 8B, C8, E8, EB, 1A, 00, 00, 89, 03, 48, 83, C4, 20, 5B, C3, CC, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 48, 8B, D9, 48, 83, F9, E0, 77, 7C, BF, 01, 00, 00, 00, 48, 85, C9, 48, 0F, 45, F9, 48, 8B, 0D, 35, D1, 71, 00, 48...
 
[+]

Code size:
8.9 MB (9,343,488 bytes)

Scheduled Task
Task name:
{637BBD62-69AF-40B8-9600-916FDCA7FCAA}

Trigger:
Registration (Runs on registration)


The file roguekillerx64.exe has been seen being distributed by the following 5 URLs.

http://mirror10.fosshub.com/.../RogueKillerX64.exe

http://app.fosshub.com/download/.../3dbc6ca1379db283b190cb6b9822729b

http://app.fosshub.com/download/.../eaab42f89fd254d34bac1595189b4798

http://app.fosshub.com/download/.../d4e18b98cbdcebdafde1d289b0e025df

http://app.fosshub.com/download/.../29d17c366341afbf3d9281672e17d2bb

Scan roguekillerx64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.