» yet_another_cleaner.exe
Overview
Analysis
File Details
Downloads (36)

yet_another_cleaner.exe

Downloader

Elex do Brasil Participações Ltda

The application yet_another_cleaner.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 17 anti-malware scanners. The file has been seen being downloaded from adm.soft365.com and multiple other hosts.

File name:

Publisher:

Elex do Brasil Participações Ltda (signed and verified)

Product:

Downloader

Version:

2.8.1.1

MD5:

0ea734bcced827153c4d99a03fa6e5c7

SHA-1:

c7540b614cb9f5067f83393fe5254285d4587ee7

SHA-256:

b32798e222a7be39220d977026938fcb4814f53943dc33f1b184e3937cdbe97a

Scanner detections:

17 / 68

Status:

Potentially unwanted

Analysis date:

11/30/2024 11:04:57 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

TR/Dropper.Gen

7.11.118.242

avast!

Win32:Rootkit-gen [Rtk]

2014.9-140214

Bkav FE

W32.Clode48.Trojan

1.3.0.4613

Emsisoft Anti-Malware

Gen:Variant.Jaik.462

8.14.02.14.02

ESET NOD32

Win32/ELEX (variant)

7.9154

Fortinet FortiGate

Riskware/Elex

2/14/2014

IKARUS anti.virus

Trojan-Dropper

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.174.10469

Malwarebytes

PUP.Optional.Elex

v2013.12.10.01

McAfee

Artemis!0EA734BCCED8

5600.7285

NANO AntiVirus

Trojan.Win32..crdmoj

0.28.0.57029

Reason Heuristics

PUP.ElexdoBrasilParticipacoesa.T

14.3.18.15

Rising Antivirus

PE:Malware.Generic/QRS!1.9E2D

23.00.65.14227

Sophos

Elex

4.95

Total Defense

Win32/Tnega.KYMYOTC

37.0.10498

Trend Micro House Call

TROJ_GEN.F47V0122

7.2.45

Vba32 AntiVirus

Downloader.Elex

3.12.24.3

File size:

878 KB (899,056 bytes)

Product version:

2.8.1.1

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\yet_another_cleaner.exe

Digital Signature

Signed by:

Elex do Brasil Participações Ltda

Authority:

GlobalSign nv-sa

Valid from:

9/24/2013 6:46:21 AM

Valid to:

8/17/2014 9:28:53 AM

Subject:

CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11215F51916F2BB9F54E82871FEA88CE8F5E

File PE Metadata

Compilation timestamp:

11/13/2013 4:20:27 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:6zSncq3EvVWjkDIMC7o2ejKUBL1ZfODvjLEh/s+2xADQLpIScP/t+q1GMZCsvCoW:AqUt2/of3L1ZfOqGqSSY1DbojuJ

Entry address:

0xFD70

Entry point:

E8, 8D, 75, 00, 00, E9, 39, FE, FF, FF, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41, FE... 
[+]

Entropy:

7.5976

Code size:

176 KB (180,224 bytes)

The file yet_another_cleaner.exe has been seen being distributed by the following 36 URLs.

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2706093013&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2701855159&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2709142780&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2707450556&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2709693380&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2704714811&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2702012042&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2703948976&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2712475281&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2707440875&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2705695946&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2705868784&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2704799325&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2710109450&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2696861992&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2710758096&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2706108610&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2709630273&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2702986362&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2710311093&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2708377040&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2707748935&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2701882090&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2711256973&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2711241193&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2711233134&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2697174169&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2697000126&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=ava&subid=2696913525&lplink=http://www.yac.mx/download/ad/.../yet_another_cleaner.exe

Latest 30 of 36 download URLs

Remove yet_another_cleaner.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.