home

virtual-wi-fi-router.exe

WifiHotsopt

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘VirtualWifiRouter’. The file has been seen being downloaded from dc271.4shared.com and multiple other hosts.
Product:
WifiHotsopt

Version:
1.0.0.0

MD5:
8ff59ca6ac6310ade00a0fde2569d227

SHA-1:
72c7b964e0bcb02833581b9aa4a74125700956dd

SHA-256:
9de821f0dbf3a402f9d173d1cdac1fa47e0d576fb26d07e3543c1cc271587ae8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/13/2025 5:28:10 PM UTC  (today)

File size:
1.2 MB (1,283,584 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2011

Original file name:
VirtualWifiRouter.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
9/23/2011 4:11:09 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:6f6X+F9pfZ5cka4UcwO9AavTMXE1K+x/unHWJ9N5+O6Sdmy3yY4rwb7JZJ1K+x/V:6f6YpfZE4bV9AaWWZ4rwbdWz

Entry address:
0xE020E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
4.0508

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
889 KB (910,336 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
VirtualWifiRouter

Command:
C:\download\virtual-wi-fi-router.exe


The file virtual-wi-fi-router.exe has been seen being distributed by the following 6 URLs.

http://dc271.4shared.com/download/.../Virtual-wi-fi-router.exe

http://s6091.minhateca.com.br/File.aspx?e=F0IAY0v92EKK4aDrGjHLpJtE0aBBiK7Dw0f2Q2_w9yqO85XqqV9_-3MvAPmslp9H97vUVVkD1dmgRBkWvUPCwN077BA5Xma9BKy3-q7_A9_aXvtqKabTH6VO3gIfpc64dmfqiWURsgFzgElfwslB7Q&pv=2

https://doc-08-bg-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/b237pvk2oo92sqqo5d08siikt2n44ov3/1424966400000/11104984208841847478/.../0B7ujgpCjqPf-NS02WklkUV92Mmc?e=download

https://doc-08-bg-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/nrirm6svcu4fub1biimlkch87muv3nkr/1426564800000/11104984208841847478/.../0B7ujgpCjqPf-NS02WklkUV92Mmc?e=download

https://docs.google.com/uc?authuser=0&id=0B7ujgpCjqPf-NS02WklkUV92Mmc&export=download

https://docs.google.com/uc?id=0B7ujgpCjqPf-NS02WklkUV92Mmc&export=download

Scan virtual-wi-fi-router.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.