What’s INISAFECrossWebEXSvc.exe (INISAFECrossWebEX Svc)? Is it safe or a virus?

INISAFECrossWebEXSvc.exe is a file associated with INITECH Co., Ltd.'s INISAFE CrossWeb software, a web security solution designed to protect users from online threats such as malware, phishing, and other forms of cyber attacks. INISAFECrossWebEXSvc.exe is a service component of the software, responsible for running background processes and managing the application's web security features.

While investigating this executable, I came across a concerning report on the AhnLab website. According to AhnLab, this executable may be associated with malware. They reported, "The AhnLab ASEC analysis team has discovered that there are 47 companies and institutions—including defense companies—infected with the malware distributed by the Lazarus group in the first quarter of 2022. Considering the severity of the situation, the team has been monitoring the infection cases. In systems of the organizations infected with the malware, it was found that malicious behaviors stemmed from the process of INITECH (inisafecrosswebexsvc.exe), the security company."

AhnLab also provided the hash "MD5: 4541efd1c54b53a3d11532cb885b2202" to help identify if your system is compromised by this malware.

At SpyShelter, we couldn't independently verify if INISAFECrossWebEXSvc.exe is indeed malware, but the information from AhnLab could be valuable if you have this executable on your PC.

Researched by Laura @ SpyShelter Labs