home

xkyuizxr.exe

The executable xkyuizxr.exe has been detected as malware by 5 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Auto-Discovery Instrumentation Image’. While running, it connects to the Internet address 151-182-245-137.red-acceso.airtel.net on port 33982.
MD5:
ca33a896b71545bb7c345164a36347d5

SHA-1:
22dc44f00df3d465a96c97933814308a05ea6e69

SHA-256:
ba2e8e7b8126a7e07b8352b4dd24a18eda1016915597413b56a9ab9d61b09d14

Scanner detections:
5 / 68

Status:
Malware

Analysis date:
11/23/2024 8:03:03 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
160917-0

Dr.Web
Trojan.Bayrob.57
9.0.1.05190

ESET NOD32
Win32/Bayrob.BT trojan
6.3.12010.0

F-Prot
W32/Nivdort.L.gen
4.6.5.141

F-Secure
Variant.Zusy.189044
5.15.154

File size:
517.5 KB (529,920 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
3/1/2015 2:49:53 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x54C61

Entry point:
E8, A4, 68, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 90, 5F, 47, 00, E8, 19, 2D, 00, 00, E8, D9, 41, 00, 00, 0F, B7, F0, 6A, 02, E8, 37, 68, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, A7, 04, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, 22, 01, 00, 00, 59, E8...
 
[+]

Entropy:
6.8388

Code size:
447 KB (457,728 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Auto-Discovery Instrumentation Image

Command:
C:\chsrirhshlyyyk\psbaebivtgit.exe


The executing file has been seen to make the following network communications in live environments.

TCP:
Connects to abts-north-static-138.112.160.122.airtelbroadband.in  (122.160.112.138:27440)

TCP (HTTP):
Connects to unknown.prolexic.com  (72.52.4.119:80)

TCP:
Connects to static-5-2-166-192.rdsnet.ro  (5.2.166.192:41199)

TCP:
Connects to dynamic-37-142-223-103.hotnet.net.il  (37.142.223.103:22969)

TCP:
Connects to 77-57-186-45.dclient.hispeed.ch  (77.57.186.45:43519)

TCP:
Connects to 242.190-154-74.uio.satnet.net  (190.154.74.242:31770)

TCP:
Connects to 151-182-245-137.red-acceso.airtel.net  (151.182.245.137:33982)

TCP:
Connects to static-86.125.19.130.craiova.rdsnet.ro  (86.125.19.130:27743)

TCP:
Connects to net-2-34-19-50.cust.vodafonedsl.it  (2.34.19.50:35833)

TCP:
Connects to host-41.46.20.41.tedata.net  (41.46.20.41:48405)

TCP:
Connects to 88-82-203-114.jetnet.es  (88.82.203.114:40413)

TCP:
Connects to 86.125.219.12.bb.fo.static.rdsar.ro  (86.125.219.12:21375)

TCP:
Connects to 5.34.147.158.dinamic.user.wimaxonline.es  (5.34.147.158:23144)

TCP:
Connects to 188-25-131-224.rdsnet.ro  (188.25.131.224:26337)

TCP:
Connects to 143.sub-70-195-4.myvzw.com  (70.195.4.143:41500)

TCP:
Connects to mail.kau-om.com  (212.119.80.21:36542)

TCP (HTTP):
Connects to ip234.208-100-26.static.steadfastdns.net  (208.100.26.234:80)

TCP:
Connects to d-79-117-196-121.craiova.rdsnet.ro  (79.117.196.121:45688)

TCP:
Connects to customer-GDL-117-149.megared.net.mx  (177.240.117.149:27603)

TCP:
Connects to cblmdm72-241-47-203.buckeyecom.net  (72.241.47.203:22399)

Remove xkyuizxr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.