home

vpndownloader.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

This is installed with multiple programs including Cisco AnyConnect VPN Client and Cisco AnyConnect Secure Mobility Client. The file has been seen being downloaded from vpn.cdgdental.com and multiple other hosts.
Publisher:
Cisco Systems, Inc.  (signed and verified)

Product:
Cisco AnyConnect Secure Mobility Client

Description:
Cisco AnyConnect Secure Mobility Client Downloader

Version:
3, 1, 03103

MD5:
9b56a5fa21dc942ea07d16276bf4502d

SHA-1:
577ed830e60e2c38d7225a847aa8a8291c069723

SHA-256:
37c53c38c44a9ae2e98ab26b6f7cc4228c991f881ddc57289678e3fea51f0cfb

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 1:58:59 PM UTC  (today)

File size:
893.4 KB (914,832 bytes)

Product version:
3, 1, 03103

Copyright:
© Copyright 2004-2013, Cisco Systems, Inc.

Trademarks:
You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:
vpndownloader.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\vpndownloader.exe

Digital Signature
Signed by:
Cisco Systems, Inc.

Authority:
VeriSign, Inc.

Valid from:
1/2/2013 7:00:00 PM

Valid to:
4/4/2015 7:59:59 PM

Subject:
CN="Cisco Systems, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Cisco Systems, Inc.", L=Boxborough, S=Massachusetts, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5ECE4ABD054DB0EE1ACEF57C4D3F442C

File PE Metadata
Compilation timestamp:
3/26/2013 11:40:59 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:JNY0S5BiclMOUKQPjICrLh3KrAW+SbOAxYeC/rhDPQUYQj3Z:JNY0S5BiclUkkLeyrHYQj3Z

Entry address:
0x6485D

Entry point:
E8, 43, 05, 00, 00, E9, 58, FD, FF, FF, CC, FF, 25, 28, 47, 47, 00, FF, 25, 2C, 47, 47, 00, FF, 25, 30, 47, 47, 00, FF, 25, 34, 47, 47, 00, FF, 25, 38, 47, 47, 00, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 60, 76, 4C, 00, 89, 0D, 5C, 76, 4C, 00, 89, 15, 58, 76, 4C, 00, 89, 1D, 54, 76, 4C, 00, 89, 35, 50, 76, 4C, 00, 89, 3D, 4C, 76, 4C, 00, 66, 8C, 15, 78, 76, 4C, 00, 66, 8C, 0D, 6C, 76, 4C, 00, 66, 8C, 1D, 48, 76, 4C, 00, 66, 8C, 05, 44, 76, 4C, 00, 66, 8C, 25, 40, 76, 4C, 00, 66, 8C, 2D, 3C, 76, 4C...
 
[+]

Entropy:
6.5597

Code size:
456.5 KB (467,456 bytes)

The file vpndownloader.exe has been discovered within the following programs.

Cisco AnyConnect Network Access Manager  by Cisco Systems, Inc.
Publisher's description - “The Network Access Manager is client software that provides a secure Layer 2 network in accordance with policies set forth by the enterprise network administrators.”
www.cisco.com
7% remove it
Cisco AnyConnect Secure Mobility Client  by Cisco Systems, Inc.
Publisher's description - “Make the VPN experience easier and more secure with the enhanced remote access technology of Cisco AnyConnect Secure Mobility Client.”
7% remove it
Cisco AnyConnect Telemetry Module  by Cisco Systems, Inc.
Publisher's description - “The AnyConnect telemetry module for AnyConnect Secure Mobility Client sends information about the origin of malicious content to the web filtering infrastructure of the Cisco IronPort Web Security Appliance (WSA).”
9% remove it
Cisco AnyConnect VPN Client  by Cisco Systems, Inc.
Publisher's description - “The Cisco AnyConnect VPN Client provides remote users with secure VPN connections to the Cisco ASA 5500 Series Adaptive Security Appliance using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol.”
9% remove it
Cisco AnyConnect Web Security Module  by Cisco Systems, Inc.
Publisher's description - “You can deploy the Web Security module and benefit from the ScanSafe web scanning services without having to install an ASA and without enabling the VPN capabilities of the AnyConnect Secure Mobility Client.”
8% remove it
Cisco Unified Attendant Console Enterprise Edition  by Cisco Systems, Inc.
9% remove it
VPN Client  by PT Bank Central Asia, Tbk.
www.klikbca.com
About 5% of users remove it
 
Powered by Should I Remove It?

The file vpndownloader.exe has been seen being distributed by the following 3 URLs.

https://vpn.cdgdental.com/CACHE/stc/1/.../vpndownloader.exe

https://vpn.energa.pl/CACHE/stc/1/.../vpndownloader.exe

https://obsras01-ch.zurich.com/CACHE/stc/1/.../vpndownloader.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.