home

Windows Loader.exe

The executable Windows Loader.exe has been detected as malware by 17 anti-virus scanners. The file has been seen being downloaded from e.mail.ru and multiple other hosts.
Version:
2.2.0.0

MD5:
e7be2c033c6ab0ba199b4717f98bc947

SHA-1:
6c964ec7100ad55922e186a157a445825998cfa4

SHA-256:
27c81c938edf0a2a06d8d80de7e852a61d8ff89ff17ab69b7818858edaa3c446

Scanner detections:
17 / 68

Status:
Malware

Analysis date:
11/24/2024 7:50:39 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
HackTool.Gendows
7.1.1

Bkav FE
W32.Clodf36.Trojan
1.3.0.4923

ESET NOD32
Win32/HackTool.WinActivator
7.9310

Fortinet FortiGate
W32/AutoRun.BSY!tr
12/24/2013

IKARUS anti.virus
HackTool.Win32.Gendows
t3scan.2.2.29

K7 AntiVirus
Riskware
13.175.10881

Malwarebytes
Hacktool.Agent
v2014.01.20.04

McAfee
Artemis!E7BE2C033C6A
5600.7271

Microsoft Security Essentials
HackTool:Win32/Gendows
1.165.247.01

Norman
Troj_Generic.GKUXH
11.20131224

Panda Antivirus
Trj/OCJ.C
13.12.24.04

Quick Heal
HackTool.Gendows (Not a Virus)
12.13.12.00

Rising Antivirus
PE:Trojan.Win32.Generic.13F8DFFC!335077372
23.00.65.131222

Sophos
W32/AutoRun-BSY
4.96

Trend Micro House Call
TROJ_SPNR.02AI13
7.2.358

Trend Micro
TROJ_SPNR.02AI13
10.465.24

VIPRE Antivirus
Trojan.Win32.Generic
25600

File size:
3.7 MB (3,931,485 bytes)

Original file name:
Windows Loader.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\windows loader\windows loader.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
49152:VEYCFEWz3sKcA1990FW6drnq9QF/Fs454vn6puWV355FXw/+euWV355FXw/+AuWy:VEYzhnA1990FW6drnq9QpFXmv8

Entry point:
60, BE, 00, B0, 58, 00, 8D, BE, 00, 60, E7, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 77, 80, 21, 00, 57, 83, C3, 04, 53, 68, 95, F9, 08, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Entropy:
6.7287

The file Windows Loader.exe has been seen being distributed by the following 5 URLs.

https://e.mail.ru/cgi-bin/.../x-msdownload&cn=Windows Loader.exe&cte=base64&notype=1&file=Windows Loader.exe&mode=attachment&channel&x-email=sveta.koval.1980@mail.ru

https://doc-10-04-docs.googleusercontent.com/docs/securesc/2rahfcs8s5m20klnj8dpre14n5n1jboc/pp8pkrv4bjvb5ehe5h6j22sotdhbuhh5/1461765600000/.../09841300846589652721/0BwecrTqCEJDTM0hGbWZoa0ZnOE0?e=download

http://media.iresam.org:8080/access/logiciels/Systèmes d'exploitation/Windows_Loader_v2.2/.../Windows Loader.exe

https://cbmizq.bn1301.livefilestore.com/.../Windows Loader.exe

https://doc-0k-a8-docs.googleusercontent.com/docs/securesc/85o3bcba0s5n6eodujs2neb6sukr6tcc/89a77gr7v25bn4debbc0qn07e2vhpaa4/1451332800000/.../18438223320058911225/0B9aQ4OXiaMASVm9VSGhCakU3ZW8?e=download

Remove Windows Loader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.