home

yet_another_cleaner_mat.exe

YAC Security Protection

Elex do Brasil Participações Ltda

The application yet_another_cleaner_mat.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from adm.soft365.com and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
Setup

Version:
1.0.58.18343

MD5:
7e799f9d4360fe4bbe19980928074ba4

SHA-1:
e07ba5cb1e726fc4a47e3d1fa35e001b6b7747ea

SHA-256:
941c176fcfbf02072bf95a28e251837f1c452eb4e901107ccf6099359f60651b

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 4:44:39 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Elex
4.0.3.14116

Dr.Web
Adware.Mutabaha.73
9.0.1.0310

ESET NOD32
Win32/ELEX.AU (variant)
8.10292

Reason Heuristics
PUP.Optional.Installer.X
14.11.6.5

File size:
890.1 KB (911,504 bytes)

Product version:
1.0.58.18343

Copyright:
Copyright (c) 2011-2014 Elex do Brasil Participações Ltda

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_mat.exe

Digital Signature
Signed by:
Elex do Brasil Participações Ltda

Authority:
VeriSign, Inc.

Valid from:
6/23/2014 2:00:00 AM

Valid to:
6/21/2015 1:59:59 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=São Paulo, S=São Paulo, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5C6950D0A05A1CD63164D1E1EB1FFB8A

File PE Metadata
Compilation timestamp:
11/4/2014 10:33:54 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:lPMEsc/ISIgkjLGBx4twfS43tQ1fCowk8oiCp2ErgxobeaJ5mXnkJRgpGG:lPa+tkjLGzf9Boh8ofkEsoemIXkJipGG

Entry address:
0x11153

Entry point:
E8, 2B, 68, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 83, EC, 10, FF, 75, 0C, 8D, 4D, F0, E8, 73, FA, FF, FF, 8B, 4D, F0, 83, 79, 74, 01, 7E, 15, 8D, 45, F0, 50, 6A, 04, FF, 75, 08, E8, 40, 69, 00, 00, 83, C4, 0C, 8B, C8, EB, 10, 8B, 89, 90, 00, 00, 00, 8B, 45, 08, 0F, B7, 0C, 41, 83, E1, 04, 80, 7D, FC, 00, 74, 07, 8B, 45, F8, 83, 60, 70, FD, 8B, C1, C9, C3, 55, 8B, EC, 83, 3D, F8, F1, 43, 00, 00, 75, 11, 8B, 4D, 08, A1, 40, CF, 43, 00, 0F, B7, 04, 48, 83, E0, 04, 5D, C3, 6A, 00, FF, 75, 08, E8, 89, FF, FF...
 
[+]

Code size:
142.5 KB (145,920 bytes)

The file yet_another_cleaner_mat.exe has been seen being distributed by the following 23 URLs.

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=au4DFicpbzadaIQFx90QffNg0OyLVnFCfGhuQLq049n87YBv0WPIVjf6kWivPmuxnYvRAWEcLtSrlXNozQkjNXF6bRz1yud2rCGCbW5IOMvb73UE9gAPreE6RccKsHknT4YAGfAQnIpwNQc_DbLRVzhwvsBYP4D96qfnvp5Z93-Ht8DMu2obaE6sDchm7wBf9ylVYHUpfgBIvbS44T-qRrKpLf6kQJO80m37vrsatGNQP7a6J6exxtdhJRu5wCwepl0aZPrF-vjbT9nwShgBkqeDpXnjmxRndQE9vRvudmiLZhSR7tm1ysgHfDW7g6J2wK068pp6suwLSyYx66Bvqdii3UwXbshq0rdej2C1c7SvBwn-lcCjJeOibxc3zKaHgX7LQF5N7i6TVKcrdXewxvH3nGs0wora5A0-NtX6wXRgJI-OzemZqVw5OHTO3Rk&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://ads.adsrvmedia.net/event/click/0/pzrZ6BI_P-N5uJlEf18s7CvhZUkeo5NiZaJPSqkH-GWhSyizH37HebJGy3pb1TqxwdMsWnHX-XHqbNa-_8cdQGyPmnF8QRg-fjIC5QXz1pY0yc8RW6405GU8FMZ2XPslfVzlmjBhbSdDPClYVLXdI1mmJct1H1_fzNnHPmX56CXziBLv_qSygtpamQdTphnckR_Rf8nLiSN9H8JDmG9sS4DMVuTGH6-O1_Zv_TzLJLNPHSqhsc-X4IadXuEVVA0tFL2WGv4qTJ8AEq3PfC0NxB54tsLt8KVFNXPUvKfE2TKp3Y38xL6f5zXV-2I5fpi636bIyQxGIa5_a_tq69mBobzMgjLEVG008dJR_uD0waW4fMT7TgQ9TEYV_c42VRblKsC01XaJv6VM2DMewA81mxZNUWzMLoKnoIWzC40mkJ2NVagjoq9Ls1k/.../

http://ads.adk2.com/event/click/0/3NFf4O5mhYtXeLRgQMhRBMWCDqTKeCGzDGY5ZA7HmcDbGOiHdKRlskqHm7cG-OZntJXN3J3MwgsojkXJMdUsk8zuWas66cuj2MRs4uCwgQNoD4Nv5LROpjfsTahTaq5DY-0lVeco7dUQMm9WNfNX1qd6liz5v_zQeOt3y-Y6zeVNgv4gQVs8AKR8RJeYIhUKW2odzzGyOdz6GgwgdeyiSOqt3egfNBS5rGPnc7YBs6yYKgibuvIK06itTf8xF0cdwR9z2wtFR5jClJ60d8ucnVo2a_MOdg2FN-L62U20KPALdCFenM0Iglhg1LOFpa4JE92C92vJ6mRm6UaTmJ5OKln9Q4AvvAPvMrH4fKZo1vXxmue6twK_N4UD8b1ZBvyFXmQ30nwu3HUunA/.../

http://75.126.133.151/download/.../yet_another_cleaner_mat.exe

http://ads.adsrvmedia.net/event/click/0/jU3CJpObusrJU-qYnV93xmGTCMwaZQ4QjI4LtKV2scOYtc5Im_M0nyRpnclBsCC3mlEChBMMZCqLKf3eGuMQQT4mNFsSOsLC56k1f3EgTtlAf5KQk4b1nINPIuvNjXkSOS6Hh_ucltfABrluexIUDM9GnkJdwA0W5p6HjOTi20jSpvCICQyqzQcQB_lkZu8cYjgBN89Wdx0O_hSHBbe7givpLiNO25gFdcxCEPEHwHi3NLCRPQx41DgNqa-DOnzA4pws_lzcW0i8WDAz_TNILH6RqlCGejpYVf3a0cNbvb-3eknJimtGNFXQmF7Ts0WKNkVAIueZS2zzvx5PCWsstmgxHeYD1awGxczi2yjp7iFLo7-upzCCo8H3ImhinpEnsdv140AvtguFgD9eha2LOnEEp6JG_1AVSamG8cg1/.../

http://ads.adsrvmedia.net/event/click/0/CES7k4diMAdl5Od7W_r768f8EpL6HW63KxU91Bwp_1UOZvQG0tdr_xr_2cFyFKbwkg8vElquj3Lq57ombYY8XpVornXWmubkHF6Q5mSM-fDYUYvvB_u32waf8sacqZQJogL6lyBqXRe_b-AD_QNRNI3xKr0u5MlXmwQlwJQFrslDAMXWz1OMnot7EmFMDLGjWsmV44PONWCmLCfow4YeKk-uEFNi8o95vG8UOQB1MkomLtfU2HEidau0174aciNXoxAy_CF_019lY8Y0Bd23nEU5kbjkvYswNCQIHXSs-griRIMS3TXoDl9RIWxhf_4XqPw9m-5bVh1QR9QsUdpHlQJgtqHABiDa9xQh6Z7WoO0ktEqfPp5d-86-6qOANrBN9vbF3eW_2E1rOJK33z4GMk5CMOA7j1z2C_dih2NEVZfuqsc1/.../

http://ads.adsrvmedia.net/event/click/0/gRgnhq9jxCR4SMlrrAEKRfchHejHuz9eCimEkt2chLGtCHG5gXApUx-f9_z5DsGp6HHrQyV8JWQhANEyKjVk-bNQNaFeYYjm7Gz3ySwNUw8iCC9y64IJkHNadqTen1WQv1A0CF1cRnKOc0ThJTWxGgEg7N_bd6WVlCI8eoIO73TwI_669uaHyD7VU_0pT2iGQhcMpCq_IM4aT9IgiaasRKNGqt41F6Lh9KfPDgv-9XKKJJWWtzzBqWxcPqQLSiQVg-j0c6fwYX9Um0tjutabhpXl1i2BPhj43PEBPoatkf1xukToocyo7v8IjJYU0_MXROd7X_paKtosKoIU493m0W4XEppW-gwaeyGKNTuhbLdprzy65xkwmofHR12a74yPoVt3-evX3ZBnrrEq82YEdL0CVlI2VGSHaF1-gxh2kyycHLI/.../

http://ads.adsrvmedia.net/event/click/0/8XddSP3jXdRd2k3QQsDmnaqIaXwSmA2bpcrjvb-GNgbp7bJfIMwQbAKOaYPnTZfaGSg5IQiq2H-zK_dxmUr9Qvz_KOH421bS6y2E77fT4UEIg3C1H6tAamVTib_Kjkp3qgsuYhBycyjRFQp3VdH0qexgS1NM9e3yP-TwUk76RVb6p4MhiVDVpfHhIqrwCObvZJTa1-584mulUyymJZy_ojTzrD5K6yZmGEe6c_CZ6sNhvM8o8Q4UV21XNMzdZUNciXtsyHoKsvXnk9lUFaPWuASgHqH6DntvGD2mfllQEezPSEjZjLQHIY2snbEvsMvwpyHFOEmlZC8xlwKES3Mne4zSyZ8wl5SaFqNjWR_gvvIjrV77rH_CSd2S_x4BsNYN5pZNtA-O5FHYJQ6PWh197CrI/.../

http://ads.adsrvmedia.net/event/click/0/g-wJ9OW0sd3giBa4Rs9yG5wnO_H3_y34-OLvUhXbZfZ8m_b5zC33xgpCo5wQf60dBqK53Lzqunh05YSJ7hq9Yo3qLkv9GHVUEfOdRTHx5JQnZl8C5VcqcAkDhy90fEuL7ZSgnJ7BY2CtqjNNMYJNT_LnTfNpycZQsKTGxy5AgYE6Upa8QwX0TK3tbhewHeee5d2aoPDS9Rq_ZFVe8lZqgRwjjtMCifLLCGg2zvEF9_ymoAgfdahbt2f9evnAz-hEUqirCPzTWiAoVXWXYz1Q01ATyWv4lY11LYCUzouQoLiRJwG2ankPcrIAuOTJkwdpwcTT-iK2g339Dn0ilnXAf8TjoY-PrffTZIfrQqxtFGr9br96DUOtxh4kSnw-KLIPgrXRB9ai_eAEYeYBbFsgI6165cxkCIfw8Ot_U50/.../

http://ads.adk2.com/event/click/0/ZuCpRYcG-mWZMFDz-CJdv-sM5UvsHVNW0n6FVDFcdtImx8EixZBvK5RSmbdEXphcbilNudRxtqP0Ms4T-7XDmoBd7tJMPcN5BtjGu4evBNh7jXCUjpJu7NY97hJTP89qS1l8frwkTeL1a6yJHoy2HpC3FDZkd1nQK62lwccM-Fw_fj31fNmxolDwDYENkC-WG3mZvRDb_mInOC5P8YvA52OqS9PixtwnPZxpV6JMQMC7iqSYKPxwJ_FWU4HQ3lKyjWXULMPdYrZZjrvV48ylRY9zEcDXMZGSNpNi_ZxnJe2RpCwG1gdLbNtTAOrTuBeyYemAqAk-BzstknnPRqLpkwv13nAHhut2a7UBY4eQdLUbEtgYA_84C59oySt-6_1eO4xpGiHJefgVJi10N8mPceqpGg/.../

http://ads.adk2.com/event/click/0/AQPB_X0DqRCitul2gTeQVEI1GQ-nSjJmVNeJSV_5JEh9GWSpFsLtKkWnXuzPFXuTbHSMfIBct6ryf4R3jxzQ2fPDA9U3dfuEO0iEZOkpF80IotYq1tGusq5ETf_gEZFn8klmrsQITAvY75w2GpxSluBgGBgPruR82eXMbaz5GrqpPyqEGr_oo7KLCTlkvMGP0j7nkeMbZrln3KFrmDkdS0abDM-Jp0PdEO2_8EtQ4jc9p8nUrlzrN7aQc0_DXslcVQ4KfngB_rQ52hzbq_L_WHj5n88RtmEX4aqqLqgD9C5ANxObF-j4dUWZENGHAjQZi2z1Pm4pfNV1iRVghT9pckUjMqg60ipWfkdfkD7UZIGpLLyGEQPSWoJiFKVfqjLJSlD22nj_VimatCJ3rI4Yq78/.../

http://ads.adk2.com/event/click/0/M3Mge1zYdMP0PgstasNls53IY-s1CpVY0UYyTUVbqdXHAoAoorkG9UX4D_Rky5dVQ7fInU-5L2fQLpod5yNFbfHnXKsdsFb-jvVNKK_NpUFjmVApnNR2n1jbO4ykdLskRklULpM41Mz0zKWn-hSLdja1h-USjSfC_rCOJKbbi7bBZhmdl3fA-gK7lGVcl7iNzy2Sf_E00xcGBHWAOk-LMZGlTMildpw2OjgBQYDU6zyAEDFEfCAH8-ARqFiLDVRT2gzrx1zfo_ykr4ndQd7Q2rib2LCXYIlJpFzqoq0aoImyNui9mZsHGZXqvM4WEObY4Arp-jnZLThP3tDVTPibpz4YjcAGCYnEXgietLgZ5kQBUIeax2u8l__BR8XN5JqQNYACI7hRdyuhErJ77PD5002uIA/.../

http://ads.adk2.com/event/click/0/EM_xE3efU13WDCsB1Boj5UB8dhiCPnBcjec_BrWC2vAQUFbmA2Ayx7u38VNR5jxNGIITdQ0tx8ZKwmxh5EK-6ImPfa_Bie89qkGLqpa86sqTQyu8WKAO9oVQ8vKNjf7-x2VSbo5qsW6sRm0wdvIRKiRVOeLM_s9t8SSmUW2DxZ8Y4_NPKGZOrFwueqcUuxmwyWsJJyA0yBedWEGQCDJurU-0_s1qCkjbANk2qCPJztM5gr_-HPSySLmooeRX2fdZnVCfhyOzswkfTRBu7E6PdOD-Qw68FI7-W52pD1-JeNHLNosY48S23XA9kcPgOOBDI4K1W5zdBVaX953m60dueRNdqLYTp7eP3Py14SWEQ91bSGL9B2tswG6sNKG_2ZfOXTnNUbKEDpQLAjo5Nh99UVgxi7PV3pQ0mFzzi-zF/.../

http://dl2.yac.mx/download/.../yet_another_cleaner_mmacn.exe

http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=hYBNwcXdtmjEIiqu46-OHdfgVX6G2hqjZ6kQgJj9klXp6DbHO0StxtXYgf5Zam6gyagFBNwKD0dkDv--LMEzFwEvKkPHY9OFfRFBBwJ9e4Sktu3kb8e9Rs0by1AQ5D3J-LPxVML5QQ7CQLE8QXpCuek9GbmQAblBjs0s3yEKS92E5jlxw6YxAiO1vJ_iN_pBwTcbtOinp46E5cQ7tEIzNcXM2_DcJDm-YDhqt2BQUJGW0JP8ui-tLpx2YNCqW5I_eoF8MFwABYxYNwmdtK5wLAAQBjDSzyhwz6o-X1i2pF7kNOkFEk4dRxoI4rLv9vwJe1OEZGgu-jLYgLGodkdDe3l3zYM0unixe_0sgME3ECRy07vb_ypHjjiRDL-I3akFtKp9-RwnHwgGNEVSn1TrI0ex4q0DHFBkfgR2DwCFQheeiQZ3Z_oJDcojaEGhgCRqh6StGhM&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://ads.adsrvmedia.net/event/click/0/hYBNwcXdtmjEIiqu46-OHdfgVX6G2hqjZ6kQgJj9klXp6DbHO0StxtXYgf5Zam6gyagFBNwKD0dkDv--LMEzFwEvKkPHY9OFfRFBBwJ9e4Sktu3kb8e9Rs0by1AQ5D3J-LPxVML5QQ7CQLE8QXpCuek9GbmQAblBjs0s3yEKS92E5jlxw6YxAiO1vJ_iN_pBwTcbtOinp46E5cQ7tEIzNcXM2_DcJDm-YDhqt2BQUJGW0JP8ui-tLpx2YNCqW5I_eoF8MFwABYxYNwmdtK5wLAAQBjDSzyhwz6o-X1i2pF7kNOkFEk4dRxoI4rLv9vwJe1OEZGgu-jLYgLGodkdDe3l3zYM0unixe_0sgME3ECRy07vb_ypHjjiRDL-I3akFtKp9-RwnHwgGNEVSn1TrI0ex4q0DHFBkfgR2DwCFQheeiQZ3Z_oJDcojaEGhgCRqh6StGhM/.../

http://dl2.yac.mx/download/.../yet_another_cleaner_brob.exe

http://www.yac.mx/download/.../down.php?pt=brob

http://75.126.133.150/download/.../yet_another_cleaner_mat.exe

http://75.126.133.149/download/.../yet_another_cleaner_mat.exe

http://www.yac.mx/download/.../down.php?pt=mun

http://www.yac.mx/download/.../down.php?pt=mat

Remove yet_another_cleaner_mat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.