This routine uses XOR, and “e1uCt.” as the key.Īnd the other one only uses a Caesar cipher techniques and ADD instruction with 5.Īfter decryption of a part of the malware code we find : Interestingly, we found two decryptor routine used by this malware to protect the string in it. But, the file is likely compressed/encrypted because we cannot see a lot of strings and we cannot see any repeatable byte patterns at the time of opening it with a hex editor. We tried to dig deeper using a debugger. Packer detector like PEiD provides no information about it.

We tried to analyze one of its variant, the size is 954,368 bytes. Meanwhile, to clean it up, users are required to register first. SecurityTool will display fake scan results, as if the computer is infected by a virus. You are prompted to download an antivirus / antimalware which is actually SecurityTool, a rogue application. If clicked you will be presented a fake scanner page: Examples of prompts related to SecurityTool are below This rogue application spread using social engineering techniques by displaying a fake scanner page or fake video codec installation that are prevalent in questionable wares or adult content related websites. SecurityTool is one of the rogue applications with the highest rate of infection. Since the year 2009 until today, SecurityTool still continue to attack computer users.

If yes, it means that your computer maybe infected by SecurityTool! This is the icon that is often used by the rogue application named SecurityTool. Do you see application with an icon like this on your computer?

Fake blue screen exe