+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Analyze the file (/showthread.php?tid=5477920)
Analyze the file - m4dh4ck3r - Nov 28, 2016
Found this in my startup.
https://a.pomf.cat/sqotep.exe
Help me find out what malware it is :\
VirtusTotal
https://virustotal.com/en/file/2da63827ad1449ca5f2888adfa9645f1eaf8b39d26ec214441ee80f3a56e6e72/analysis/1480329595/
Malwr :
https://malwr.com/analysis/ZTMyYWNmMTVkNjBkNGMwNTkwZGIzOTg2NjU0MTZlNzE/
* - GruntStyl - Nov 28, 2016
It looks to be a false positive. Seems to be a Bing service by Microsoft. I'll throw it in a VM and see what I can find. But you seem to be in the clear.
EDIT: Yes you are 100% safe. It is just a bing service file. Tested in VM/Sandbox. No malicious behavior was taking place. More then likely was using it as an update service.
* - JoshuTee - Nov 28, 2016
It's a Bing process file, nothing harmful. But why is it in your startup? Did you install any programs lately?
* - Shaggy - Nov 29, 2016
Website is currently blacklisted by McAfee Siteadvisor!
others are clear
* - Aura - Nov 29, 2016
(Nov 29, 2016 01:01 PM)czzylle Wrote: Website is currently blacklisted by McAfee Siteadvisor!
others are clear
This is because there's a shitload of malicious downloads hosted on pomf.cat.
* - LogoiLab - Dec 1, 2016
The file is signed by Microsoft.