» yet_another_cleaner_cli.exe
Overview
Analysis
File Details
Downloads (19)

yet_another_cleaner_cli.exe

installer

Elex do Brasil Participações Ltda

The application yet_another_cleaner_cli.exe, “standard installer” by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from s2s.yac.mx and multiple other hosts.

File name:

Publisher:

Elex do Brasil Participações Ltda (signed and verified)

Product:

installer

Description:

standard installer

Version:

1.0.161.23663

MD5:

4cac957f29c024182bbcb837fe7b8fdd

SHA-1:

4f094feb1a360ece7bd9f3e4d5ad41215ec661f0

SHA-256:

f857faa516f3caeea3e8d9ea65cdda7324712cf7ae59eacb62bdbd6b7cb10e2a

Scanner detections:

6 / 68

Status:

Potentially unwanted

Analysis date:

11/5/2024 11:10:16 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Avira AntiVirus

TR/Elex.1460408.1

7.11.218.222

Dr.Web

Adware.Mutabaha.163

9.0.1.079

ESET NOD32

Win32/ELEX.CC potentially unwanted (variant)

9.11352

Malwarebytes

Fraudtool.YAC

v2015.03.20.03

Reason Heuristics

PUP.Optional.Installer.ELEX

15.3.20.15

Trend Micro House Call

Suspicious_GEN.F47V0320

7.2.79

File size:

1.4 MB (1,460,408 bytes)

Product version:

1.0.161.23663

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\yet_another_cleaner_cli.exe

Digital Signature

Signed by:

Elex do Brasil Participações Ltda

Authority:

VeriSign, Inc.

Valid from:

6/22/2014 8:00:00 PM

Valid to:

6/20/2015 7:59:59 PM

Subject:

CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=São Paulo, S=São Paulo, C=BR

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5C6950D0A05A1CD63164D1E1EB1FFB8A

File PE Metadata

Compilation timestamp:

4/10/2010 8:19:23 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:z0a2K6me7Luv+eP0514OzshxvZ+NhNhM76zoBSW10jCqdpl8MwiVBbxSnE:zNgpePbOw3x+NhAMocCqd/FpSnE

Entry address:

0x33E9

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 70, 85, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 78, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, 90, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 6C, 85, 40, 00, FF, 15, 80, 81, 40, 00, 68, 54, 85, 40, 00, 68, 80, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00... 
[+]

Entropy:

7.9240

Packer / compiler:

Nullsoft install system v2.x

Code size:

25 KB (25,600 bytes)

The file yet_another_cleaner_cli.exe has been seen being distributed by the following 19 URLs.

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=6P8w-KSCThe9G5Q6c0qjeJP5GgerETVYTbQd49-7gweOnPLVaPc56vwplAUufamfR2papCDpgP_pTUhgQxtx-Z2_jVJZkNn4M7kw_7olLhDUJk2tbVjhXSHa53ttvthEM4ru9tKSZtP60K3xcskF-3Uk9iUDEVy--uKb3TrxSw9Dw9SncGy5xfrxa32ZbejkQ_OTG3KmSiUjp5t7jx3QBGXzgOrIhdOvUDXyCQrPi9T2kqVwM_iT1ymPX4l5GgMUHO1IFi0QIGYmnbL0g2vjAoIDhzNpNxh1EB3kp0YGSecd4JrcWK6aoEWNlKLLXNK2gv0HIdo3rvMdYWrvKtWPeirEB64U1rE9SVWZt5I9gRKd0iy9a9wwpdt6p_eP59qH4ZQMq5lDHA9jf6aTyl6VObSRl9AfiBFYhy_SYYPCUWMCbtevrkI&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=COXmKKpc8qcyJPYU95hHMhmKuefjH9UX5m-1tpRCtjQQ-EvkwnwGhJ89k-JY8lXbiAihv5pmzLVkLHDT6r9ypMGnEhdXYCstvWiONa1Uv0OI7kr4jkyZqe2X3Rhk371m-cTu6oOdmHtOGJeubR_u9LFZKSibBTH1-MDdl6jsCFTJQ2KikKBUAKq0emFWy9Q-1bvdM-Fkei8DW8omGCGxhq4m6jTRRiFWiZ0sKbGTXdsbOmIxJOzYYxSOe__VH_lvS5DefMdnEXEcHnpE-pW3AlLn3Sj4wJ1CwAvhlpxy2aPG8j-080LHG_ke2lukUQHKu8_Y99NIZ3oGGkNMQebQqZwfWsgdLao2i8uveBh82n6sM7D12IKyVZ4UW9O8NUkMmRRMXMv4dD_-sVFwaw5Znp660WIO2-OU3TBLYg-tOD32eT6gOQ&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=icIfQ1lBOt5qchCwZwqdorvj4lZnAcN0NR-sUbGMp-3yzG02L9_BC-r5VJU0dL9sN-iq7j2vVrDE_FpBHE39K4pzox9orP-eWo9HFau1sKEzyYLG_G07DutFoJUj2PkF1fIOK_mTvidEfvvKXWR48nPTKaN0w_s0w8v4U5AMjdlitXAan5e4N1EMT_OMQWGUP9_phNRsH0RIPsAlmR4136qX6io9kUwqbHDUrlNgIaIYiLUd0u3vkkRLC3OdByWpxtrb5cOADX9x9k5_BcOoqDIQ69hOuNW1AupuUc6eFEUA1VspNU-80F4YHboP_ZhN0KGCzWx5eyYU6MIybpDhS5W08SmADmUejO29Nn_laF9zfC36Qg0rWJzsDCMnCxLWWYQAf0nry7UTNCKrO3iBR92LLOhxY8k_bbHQ0M-pnNE9179QyotvfaDW4GA_pGDpy7RJjh97_4M1VXBxsKQJNNsZr-ALZwmp&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=n9w0tmjVHSAHH6Vc8oUEcVYk9NqUYyy9KNLRrpbw4NBo6AYIMYBtjI4dsVCyk2_EbZGzjd8AmFutEG9CoiLy9EzY9B2y9lApsfajEWfSs5KKRlTwoJbo6_WiBaSPT2PzoSjC5F4wsTuoQRbZB8cYT843RIMtCBnJJSzC5vwbBnNRQCFECo7dH1hRtYyqoQItbEkJ0H_G3jaEJwWos_EshNo4tbUZjjiUZl8AbZiiZEya9ql9r7xLekXPYEgkjVgflry9DVWElGx7tHb3oJyn-Ov52J4Gs_ZQZdU_5KJ6GKnY7A9tn0lEv4Z8VyuXktQhlWc6eIrfksLutq7_qABrr_Mef5BdfS83KBReO-mJlOpidottrZ5t-46oLznGTlpJdXtN3B7BRPgQ6sucmkxfIUuaBoB-MXY9KInug07igwgbZ3Dtw1kwvkFRBzDBQBDps0ePgG5HEpc_8wo&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=epo&subid=NTczMDF8MTA3NTQ0fFBMfDN8MXx8|d8d97a266a1d4389dee35d271d8c79fc-9118-63173&lplink=http://www.yac.mx/download/.../down.php?pt=epo

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=vZ74yAjBv-cR61SIP-PfPqsh4frt9d_3C7MEyAnc5LNW1C8borYtOinpjEMlsKC9wTcd0_TJBw1eDxhh4Tc43_fU2LDKTHp1PazymxSJCCtrqBrCswpWOZe5JJFfIxh82D2mLtOaGiQgqOeJQKQuFUTjHblyw300PlGCtFIM9fvYF88TCqoUz8ZKx_9MJijVuSJP69WvZK0nY0f7_0HlTygVWIxosK2Vw2RjZ3mrXE7ENv0YXvGo8CCyGoh97CY8I5nsCV5Zep-MZu3Y1R4X1hIZU2ey4rUDBYlFg1DGPOSfky2hNIGHyfttVM74gC1ruliaXmuZRVRhEB6meXV3FFqUqRs3-cCnP5cjoFAvuxj6s8qPkNiPXFKzNybCTLrrm15pbdGbWdWRlZgysKchkY3zreyJ78q35Rk4ZDm5vuNl-Hyz&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=epo&subid=

http://www.yac.mx/download/.../down.php?pt=gam&subid=18184

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=mJcykDbEhy5EVC-ssHJFj8hITk3r0irVO3aTRsf1Z1-bfvtIHw32U0cADChgeBWnIbEOWcLRs7lDfB0cXdzq6i0bcc6PlziN77PrlE7_tT5gdpF2FZt14B9BkXvBMAfPLLlUnkpWHMLkM7soBK1IVjeQQBGsdkVSff79BdqrF2eBAZEwSByWeZ9jPYaVwa3QV_wuYG9I5CZexzsxabiJNSlLnGMpK8gCg4Cd7ddcm3Wcn5zbjvFY3BZY0WAx-gARtIqQnp8uGegZqQCo7uZ8z9bAODS40G3vaXLAde8st3_dSP2tWUFJBCxu5OQ4P7CYHT_ahkN7KVQwnYM7Km0QQEfIiPIGaLOQ6FI6JFtreyDCB9C3PwcYZzkYryDPADtcFBUUH1FeRnkS7XdtPeUWsq4vT7FeH9Fsfo7u41wa9kCdAR3emKOHdMSWeqMhKezFVLkndj-zAW3Q0lVcsPr2BRbKOmCj6d1D&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=ymb&subid=16100

http://www.yac.mx/download/.../down.php?pt=kwo&subid=

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=epo&subid=NTczMDF8MTA3NTQ0fFFBfDN8MXx8|d8d97a266a1d4389dee35d271d8c79fc-9118-63173&lplink=http://www.yac.mx/download/.../down.php?pt=epo

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=epo&subid=NTczMDF8MTA3NTQ0fE1YfDN8MXx8|d8d97a266a1d4389dee35d271d8c79fc-9118-63173&lplink=http://www.yac.mx/download/.../down.php?pt=epo

http://www.yac.mx/download/.../down.php?pt=mmac&subid=

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=Mn_X_6t6kXK7-Qho6vVKxe1JI4h1YehlboiVYioc3wmjmFFcSH_o1fmRK94tewqszbbIEuLTplx2WRK4YktGl5W9BccBtfQBF1mK106kZllpaJl7lko1wGHbQYb0bJbW8tRu-Or6uixukDSGaek1M0Q4lSGBwgJV2g4yIK3YLm9QidmW4tQBkvgX4Jf3fi8dbrfnyOUlcFZJrO8lh1tlBhyXZs3qPjWU2lgeJfsIpZyaxK7jrYoHJaqJ85kPlwfaSu0mPF_7xYtzSWqbR2cO32slUy0R5iRZeipJoBDHVHvnz81Sr6K6ijVOtQPYmdSq5TYsJyXUeTXfrrsmWFYR37doanYPpjvYNRcE1v2oYoqLLArcaWOPjtGHEWrPvBCvu3skAKP-2fkSKo5_OnBMpbzfcW89-Y5Z7NyzzpVoxQrPvUhCyVXzvFM8oJFGyY1MMOld&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=mat&subid=152743

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=epo&subid=NTczMDF8MTA3NTQ0fEFSfDN8MXx8|d8d97a266a1d4389dee35d271d8c79fc-9118-63173&lplink=http://www.yac.mx/download/.../down.php?pt=epo

http://www.yac.mx/download/.../down.php?pt=mat&subid=123101

http://dl.yac-tech.com/download/.../yet_another_cleaner_cli.exe

Remove yet_another_cleaner_cli.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.