Is Capri-Setup.exe safe? No, we rate this exact file malicious.

What We Detected

This is a .NET Windows executable that describes itself as an installer and carries no digital signature, so nothing verifies who built it. Of the 75 engines in our network, 65 returned a result and 33 called the file malicious, ten of them from major antivirus engines: Kaspersky labels it a rule-based MSIL trojan of the Startun family, TrendMicro-HouseCall names the same family, and Microsoft, Sophos, Symantec, Avira, Emsisoft, GData, Ikarus and TrellixENS flag it with generic trojan, high-confidence machine-learning and Artemis labels. Ten malware-specific community detection rules also matched, including a stealer rule, a .NET loader that unpacks an assembly from image pixel data, and messaging-bot framework markers.

Threat Behavior

Observation from the test run was inconclusive rather than reassuring. The combined sandbox verdict was clean, no process was recorded as injected into, no files were dropped and our host reputation check, which covered both addresses the sample resolved, found nothing malicious in our cache — those two addresses are analysis-environment data rather than the program's own traffic. The recorded techniques include checks for debuggers and virtual machines, obfuscation, .NET reflection loading and installer-style command-line switches. A sample that fingerprints its environment can behave very differently under analysis than on a real desktop, so a quiet run alongside ten major detections and a stack of malware-family rules is a reason for caution, not clearance. Our own static inspection of the file contents was not available for this submission.

What To Do Now

Do not run this installer, and delete it if you downloaded it recently. If it has already been launched, run a full scan with your current antivirus protection and review what was installed or started afterwards. Anyone who needs the software it claims to provide should get it from the publisher's own official source instead.