home

11065129_stp.exe

Mobile Witch Remote Control

Prospera Software, Inc.

The application 11065129_stp.exe by Prospera Software has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
MobileWitch LLC  (signed by Prospera Software, Inc.)

Product:
Mobile Witch Remote Control

Version:
3.8.0.0

MD5:
1e80fff40ed838e9ef13db90c297dc53

SHA-1:
8fbb5a639c943faea40acdc5ff6514c6053c1194

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/23/2024 4:24:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ProsperaSoftware.Installer (M)
16.1.22.14

File size:
7.5 MB (7,897,256 bytes)

Copyright:
© MobileWitch LLC

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\Local settings\temp\{random}.tmp\11065129_stp.exe

Digital Signature
Signed by:
Prospera Software, Inc.

Authority:
VeriSign, Inc.

Valid from:
3/22/2012 9:00:00 PM

Valid to:
3/29/2013 8:59:59 PM

Subject:
CN="Prospera Software, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Prospera Software, Inc.", L=Suwanee, S=Georgia, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0DAD1F7418003A7864BBA4BD9909AE05

File PE Metadata
Compilation timestamp:
12/5/2009 7:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:+ORAZvqGtm6F7wiGQn6YjLnBnthZevZwMFnlDOcbhJb5Sm:+O2Zvx02GQ6eLtt6OMTD1JbT

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file 11065129_stp.exe has been seen being distributed by the following 5 URLs.

http://dw.uptodown.com/dwn/memov4dTfuV493rvf5S2k5yRNhe2TDcp9CJEKcaexwrM9huQItFH7yaiDpkcjE30jV7otBSc1BCZnGrAtMJ4bLKeP3MqNuP6xBaoXaGn6_pQb3vRUpxY3HFWoIkMPU52/2VrUPqapb13F9RmW18vfieVNKjtE12weFHt0UHuANHz1B2M_lzULFb0PBAVJBA01omF22Va6EGNi1qU_wRmhxb28T2-YpqGZgmLcTHa1v_mBp0PylMfDM3mZXlh8ciC4/E_TO-5FvyVUjlhWjTrNVMmd9qknS4iPfgfTE_kk_SwbYp06cMyZ34EqTXybAzRyk-5_Txfa_HLBQnW8Ub8ZIegYrUYeM_PFwp5PGwXZzxPTMGR247TYwmsqPi_wC72GI/.../

https://dw.uptodown.com/dwn/MmDd09YlJn6P6Oa-3NQcN3JEP1jcXl2A5m6zPcP38O6_-PzR4trt1e4J3hWP9JRat590skQUtMTXfpiW_QE0PhUIwDRtVlV01qBRWUD5-MwCLmS1RVZ1sz6f5QApL_90/2a9enDzJr0YSqSjkK_Zvbiv35NuPUAwzVG9rYyTPl0K6Uf3Ara64Ujtf6jNS-nJC4EDpgPcuKWbGHJ2MUqjvvE8GJf8msBpI-6Cbr5OqaKPiI_6sJLE3mzSlIrsuCXBv/i-RD_YAWYZRU6FUx2aYnc6sGT86u_R6uImMqcMgXSJQfKshTCnCURlZlOBjd2iVIVpSwonPJnHpns9LKcikxWBILDRrhDwMS1Le85VgzseJfNUWe61rFI8F-XzoY8wm2/.../

https://dw.uptodown.com/dwn/JvHnETHgrVCVeUuvXjKjLJmQFV3D7DQGapebKEreYsBJ4FnfnMi_R9JJDAwztwA_Jyuo5ja_A8Vs1uoSYZBWPkS5Li5mZtoS-hWxiGbNNRdrCo2r4Y2evWaANH646TUa/eiA4WfeGKHUaX0jNlvl3eTB_ArA7_P-9LQvSb-aAhIjs6zYYkm_JS69HMM3EPyDzIkS6ubqMmWNcLddwbML6zaeBErzdwhjUdYAM4H6K_3nw3HZz62iU7Io77lRLtCHW/uXYjszDfL8jkf4HE3n6-ASVBoooyXs1pteEbjWrxxDiJR_QVWBXO-JkevMqfZWboDzGEoBOjfMTQJvZW-mgcXfJieRZDia3dvVPZfYDHuiSMyDivYNX7aLgetBhY8rpw/.../

https://dw.uptodown.com/dwn/eUVlavHHPpJSHLijlh-XrnHr3bqqdPXn4W1JFQIxKFnseOIXf0jovtEQ2QhXJdhnUSTscP13yIn0V4Li_T47ohTFu4RRewMQhPkeH-V2UfxMCTIqhbAamiTMhvrzcflR/HJONJ9dGIs-BouYbXh3mn4T-Q5lcDJWgIj-Ex5pBkoIhH89ZRVkB6pwRCgCEGqKKsELS6fifX6j_0PmW8nDiw46cpyrqxO4jY3rhqUOyp71lEdGtjnkM9pGjTykKBRqI/R85BQ29NnD2502pdszkf1pfdPn8qRCWXY6y1k1zRW0BRqKOCRBs2rlVLqRvpe7mfroInZCwsCrb7O1YZwThM0WTRW_OepR7KVJ8AI0_fR_53_IIgU9pFEKtrs-aejcbV/.../

http://dw.uptodown.com/dwn/ygoO-PBs1rtpGS6RWLg_dtLPkhzMlP6DmtVFb_y6OnrqKh1z_j2XzKXA4DgZ9tbDXhZVPFBKWb6TbBMfKYCN3idw1CT-z_2hNgctiI_6cWFCNXsDUk7u4qx373KAhaaI/oPNcOaVxS23m8HJjVrDxh8SPHtEBeHMaTM_eUG9RGFEs2YcDHzRwGaZZ6tcNLdifydz_NDk2HZmCrlKJFzKM15UZlrVW9UXhaOb5P-VhjBlaTgL0g70ySaW5Ey_wJxfB/jdVZVeocjTyccewLlsZRgrF5UlH849-KmzX0EWdV_IBylccs43JNk4DIcVjNDfGTSHLVLWgrHjibj7HB8QxoLqgMoSILZ64U2q7R7IWcte6BRS-R70n4D2dUFwPy0dRP/.../

Remove 11065129_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.