home

Setup.exe

ZenMate Windows Client

ZenGuard GmbH

The executable Setup.exe has been detected as malware by 10 anti-virus scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from zenmate-windows-update.s3-eu-west-1.amazonaws.com.
Publisher:
ZenGuard GmbH

Product:
ZenMate Windows Client

Version:
2.0.1.104

MD5:
0157daf819ffd5957294b9f0727a904f

SHA-1:
15b1107f8b3aefde155b420ec166f36ef07c5286

SHA-256:
e000d83f48fde8b4af0d70db7e54b5ce1906acf614806b80711cfe72ea5b8bce

Scanner detections:
10 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
11/25/2024 12:55:35 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

AVG
Win32/Sality
2015.0.4568

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.96

Kaspersky
Virus.Win32.Sality
15.0.0.562

Norman
Win32.Sality.3
19.05.2016 05:17:13

VIPRE Antivirus
Threat.4758034
48908

File size:
2.5 MB (2,576,400 bytes)

Product version:
2.0.1.104

Copyright:
Copyright 2016

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
4/18/2016 9:55:56 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:VOVgMNbLtDmWhkA/UUdNoEm+UZyxReZnjOcdhtquOzUsYeYf1kUIUUUU3UUUUU3h:VGgwtKW+A/U+gZnjHdftsBYf1kUIUUUp

Entry address:
0xA5F9

Entry point:
68, 5E, DA, 74, 00, 68, 92, D6, 31, 00, 18, F6, 0F, AF, D9, 69, C1, 24, 9E, 5B, 89, 28, C9, E8, 08, 00, 00, 00, 1B, DA, 0F, CA, 03, C9, B4, 5C, 5B, B0, 0B, 0F, B7, F6, 41, 03, D7, 86, E9, 74, 09, C6, C0, DA, 81, EE, 25, 9F, 1F, 3B, 31, C9, 04, 5B, 25, 61, EC, 0A, 65, 81, FD, 2E, DD, 00, 00, 78, 06, FE, C9, 89, D6, FF, C8, 8D, 3D, 00, 00, 00, 00, 85, D9, 69, C6, F7, 6B, 42, 25, BF, F9, 05, 00, 00, 88, E5, 6B, FF, 02, 22, ED, 69, F1, E9, 01, FF, 0D, 8B, C2, 8D, 2D, D4, F9, FF, FF, 81, C5, 2C, 06, 00, 00, 0F...
 
[+]

Entropy:
7.6949

Code size:
104.5 KB (107,008 bytes)

The file Setup.exe has been seen being distributed by the following URL.

https://zenmate-windows-update.s3-eu-west-1.amazonaws.com/setup.exe

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.