Prevx Research Division
"ES8E72RT34MAIL.COM"
Malware DownloaderFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove ES8E72RT34MAIL.COM.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The filename is associated with the malware groups:
- Malware Downloader
- Malware Dropper
File Behavior
ES8E72RT34MAIL.COM has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Found on infected systems and resists interrogation by security products
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- Reads email address and phone book details
ES8E72RT34MAIL.COM has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Copied to multiple locations on the system
- Executed as a Process
- Created as a process on disk
Country Of Origin
The filename ES8E72RT34MAIL.COM was first seen on Sep 18 2009 in the following geographical regions of the Webroot community:
- Uruguay on Sep 18 2009
- The United States on Oct 19 2009
- Europe on Oct 22 2009
- Brazil on Oct 27 2009
File Name Aliases
ES8E72RT34MAIL.COM can also use the following file names:
- BANL0000(1).EXE
- ES8E72RT34MAIL.DOC
- 15102855.DAT
- 69288247.DAT
- 19702105.DAT
- 52675222.EXE
- 71563373.DAT
- 04425185.DAT
- 76687153.DAT
- 94963922.COM
- 18666199.EXE
Filesizes
The following file size has been seen:
- 63,488 bytes
- 62,976 bytes
- 121,344 bytes
- 55,808 bytes
- 61,440 bytes
- 62,464 bytes
File Type
The filename ES8E72RT34MAIL.COM refers to many versions of an executable program.
File Activity
One or more files with the name ES8E72RT34MAIL.COM creates, deletes, copies or moves the following files and folders:
- create folder C:\Program Files\Windows Live\
- create folder C:\Program Files\Windows Live\Sync\
- Deletes c:\program files\windows live\sync\acpi.vx
- Creates c:\program files\windows live\sync\acpi.vx
- Creates c:\windows\UpdateReg.Re
- Deletes c:\windows\UpdateReg.Re
Website Activity
One or more files with the name ES8E72RT34MAIL.COM interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- TCP:127.0.0.1:1085 Port:16
- Port 80 IP:200.98.197.50
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.