Private Crypter - Unique Private Stubs ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ ProxiesFood: Unlimited Residential Proxy ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Analyze the file

New Reply 
Infected 

Analyze the file
m4dh4ck3r
m4dh4ck3r Offline
^
***
HF Ub3r
Posts:
3,358
Threads:
191
Credibility:
200
Popularity:
79
βytes:
β 0
Game XP:
1
Nov 28, 2016 04:08 AM
Found this in my startup.

https://a.pomf.cat/sqotep.exe

Help me find out what malware it is :\

VirtusTotal
https://virustotal.com/en/file/2da63827a...480329595/

Malwr :
https://malwr.com/analysis/ZTMyYWNmMTVkN...U0MTZlNzE/
M4DH4CK3R's Botnet Setup Service | 50$
GruntStyl
GruntStyl Offline
[bin@HF:]
***
HF l33t
Posts:
772
Threads:
34
Credibility:
000
Popularity:
228
βytes:
β 866.3
Game XP:
0
Nov 28, 2016 08:21 AM (This post was last modified: Nov 28, 2016 08:29 AM by GruntStyl.)
It looks to be a false positive. Seems to be a Bing service by Microsoft. I'll throw it in a VM and see what I can find. But you seem to be in the clear.

EDIT: Yes you are 100% safe. It is just a bing service file. Tested in VM/Sandbox. No malicious behavior was taking place. More then likely was using it as an update service.
[Image: 5Lxbaet.png]
JoshuTee
JoshuTee Offline
[closed@HF:]
Posts:
1,521
Threads:
55
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 28, 2016 03:14 PM
It's a Bing process file, nothing harmful. But why is it in your startup? Did you install any programs lately?
Shaggy
Shaggy Offline
[Mystery@INC:]
***
Mystery Inc
Posts:
2,338
Threads:
114
Credibility:
1800
Popularity:
610
βytes:
β 1.1
Game XP:
4,421
Nov 29, 2016 01:01 PM
Website is currently blacklisted by McAfee Siteadvisor!
others are clear
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 29, 2016 07:01 PM
(Nov 29, 2016 01:01 PM)Shaggy Wrote:  Website is currently blacklisted by McAfee Siteadvisor!
others are clear

This is because there's a shitload of malicious downloads hosted on pomf.cat.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
LogoiLab
LogoiLab Offline
[closed@HF:]
Posts:
982
Threads:
65
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 1, 2016 07:36 AM
The file is signed by Microsoft.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by ailoFeb 22, 2022 09:07 PM 7 323 Feb 22, 2022 09:07 PM
Last Post: $hady
by Lykos ThrylosJul 26, 2018 01:35 AM 2 180 Jul 26, 2018 01:35 AM
Last Post: Lykos Thrylos
by SIM-2502833Sep 2, 2015 10:17 PM 1 63 Sep 2, 2015 10:17 PM
Last Post: Null Byte