home

active-boot-disk-suite-802-full-program-_id3355441ids2s.exe

mediaget-installer Module

Banner LLC

The application active-boot-disk-suite-802-full-program-_id3355441ids2s.exe, “MediaGet installer” by Banner has been detected as a potentially unwanted program by 12 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from dw2.fr.uptodown.com and multiple other hosts. While running, it connects to the Internet address sw90.ua-hosting.company on port 80 using the HTTP protocol.
Publisher:
MediaGet LLC  (signed by Banner LLC)

Product:
mediaget-installer Module

Description:
MediaGet installer

Version:
1.0

MD5:
6f1f4eb0f2cfbb18476a0fe88f3ac968

SHA-1:
b55ee60c9011e8f0d770d2dfa54c013b17ca8b59

SHA-256:
493768d2f260076176226fa6c2b5a6531be8b32d32eeefc2565a084f848444a1

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 4:47:16 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/MediaGet.Gen5
7.11.155.74

AVG
Banne
2015.0.3440

Dr.Web
Program.MediaGet.21
9.0.1.0168

ESET NOD32
Win32/MediaGet (variant)
8.9960

G Data
Win32.Adware.MediaGet
14.6.24

IKARUS anti.virus
PUP.MediaGet
t3scan.1.6.1.0

Kaspersky
not-a-virus:Downloader.Win32.MediaGet
14.0.0.3696

Malwarebytes
PUP.Adware.MediaGet
v2014.06.17.09

McAfee
Artemis!6F1F4EB0F2CF
5600.7096

Reason Heuristics
PUP.Installer.Banner.x
14.6.17.21

Sophos
MediaGet
4.98

Trend Micro House Call
Suspicious_GEN.F47V0616
7.2.168

File size:
655 KB (670,752 bytes)

Product version:
1.0

Copyright:
Copyright (c) 2011 MediaGet LLC

Original file name:
mediaget-installer.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\active-boot-disk-suite-802-full-program-_id3355441ids2s.exe

Digital Signature
Signed by:
Banner LLC

Authority:
COMODO CA Limited

Valid from:
3/26/2014 2:00:00 AM

Valid to:
3/26/2017 1:59:59 AM

Subject:
CN=Banner LLC, O=Banner LLC, STREET="lit.A, pom. 7N, 21 Serebristy bul.", L=St.Petersburg, S=Russia, PostalCode=197341, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
75D61BEBB47652BF2C5DF2DDF44F0E3A

File PE Metadata
Compilation timestamp:
6/16/2014 3:18:16 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:aj1X5lRVe9YHgY6oPW4qCsEV2X5QMs5Nshby6qtvtRSKxwjeO/xOJOsg6NSTEMf:mRVeD5tEVLL5ixyVNtRSKxw8McSvf

Entry address:
0x15EE50

Entry point:
60, BE, 00, 90, 50, 00, 8D, BE, 00, 80, EF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
348 KB (356,352 bytes)

The file active-boot-disk-suite-802-full-program-_id3355441ids2s.exe has been seen being distributed by the following 42 URLs.

http://dw2.fr.uptodown.com/dl/1403801291/.../mediaget-2-01-2796-es-en-br-fr-de-it-ru-cz-tr-win.exe

http://sub2.bubblesmedia.ru/sb/clk/s/1366/o/145/p/1312/.../0?a=1

http://mediaget.com/torrent.php?r=zerx.ru2&s=transformery-4&f=transformery-4

http://sub2.bubblesmedia.ru/sb/clk/s/1366/o/145/p/1294/.../0?a=1

http://mediaget.com/torrent.php?r=telegratis.net&s=tycsports en vivo. &f=tycsports en vivo. &cs=UTF-8

http://sub2.bubblesmedia.ru/sb/clk/s/1615/o/145/.../0?a=1

http://sub2.bubblesmedia.ru/go/.../SGdt41fhnyFQF2t1H3UQkoVzoGhP9Szx4QMnknvRNw28hE 2L0LPRm9DuSxPQ==&param=uplMxNmqQVs=&rid=407&s=1x10: Fire and Blood | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&r=miragameofthrones.com&f=1x10: Fire and Blood | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&cs=ISO-8859-1&u=

http://sub2.bubblesmedia.ru/go/?link=JnCb9lFEMswKltP4SHDBQD0955DDH5aTuUWn5zybG4ZaZ8I15XGnMLm/.../OiqQH0g3CtAl0WgDNLw==&param=DCaLd0agYDo=&rid=991&s=?????? "?????? 2 ?????" ????? ????? ????? ????? - 19 ??? 2014&r=nowfilms.ru&f=?????? "?????? 2 ?????" ????? ????? ????? ????? - 19 ??? 2014&cs=windows-1251&u=

http://sub2.bubblesmedia.ru/go/?link=w556lzjdw2ogg0 Ljkedg5gGmETIwcaPtGtY/GQpBufSFI0kSOtfybL7dAF9BTZtkZE3XBOTT3iyc/bLf3vcddlN0gHaIQZKMc0g5llkgJmko GUoo/pnkKvyl2LvzTUAqqrR4UIGTNRVl/dOprKQIXiBeQEofT8QOB901/.../D8qP2tAtuek=&param=XENHi7UoQjM=&rid=1997&s=???????? ??? ????????? ??????? 2 ?????? ????????? ? ??????? ????????&r=smotruonline.ru&f=???????? ??? ????????? ??????? 2 ?????? ????????? ? ??????? ????????&cs=windows-1251&u=&fu=

http://programki.net/download.php?id_p=975&id_url=1

http://sub2.bubblesmedia.ru/go/?link=HVUHTFA7 HiTgyBKTyBKxe2MUhTZGotfLDhLOSzJ87TwiU4ZIaMhsmDujrj9Uj gq0pfIPQrk2BCPJ0mZGeUxE0bZlbu7Y5e9JwvVKEERGxPwTzggF0hjUBu9pk5UX/.../0Kp80=&rid=991&s=????? "????????? ? ???????? 2" ???????????.&r=nowfilms.ru&f=????? "????????? ? ???????? 2" ???????????.&cs=windows-1251&u=

http://ld.mediaget.com/index2.php?r=bannerua_320_2

http://sub2.bubblesmedia.ru/go/?link=w6kc0zonkC8A7od 5zpFvjoIIbpe dc740yC VdRfx1r7JFfCniBSiDag6m9yfAVqiT3EW Eh/SyrjYE8Y81334qHiEAIG07s79yvy9kakf868d7TbyQ/F40lA9rJmD/mo1z5IiKxn9z1/.../I3HJHtEfclamXZI=&param=7Nw7kRbEXwY=&rid=1059&s=????. ????? - ???????? ??????&r=multzona.org&f=????. ????? - ???????? ??????&cs=windows-1251&u=

http://ld.mediaget.com/index2.php?r=CBN_728_blue_orange

http://mediaget.com/torrent.php?r=razym.ru

http://ld.mediaget.com/index2.php?r=advmaker728_skachat

http://sub2.bubblesmedia.ru/go/.../IMFpUPFLcDaN4gn3pskxMyNvQWEUUyCFDnjCNE1h7GErYK1OUcC4WlqT7CBqWRuHHig2yk1jH7rWI CeAmQPWvcZaR1H FqNpD38O1Hx9Pen dY=&param=JYB28vKLT38=&rid=447&s=??????? ?????????&r=miniigri.net&f=??????? ?????????&cs=windows-1251&u=

http://ld.mediaget.com/index2.php?r=advmaker300s_smotret

http://sub2.bubblesmedia.ru/go/?link=C8TVWiq3mO/n91uylyNoFjHgVoKZN6jpEakcClySqrPgq6G8rfdvnniCCdhyGRbDSamh52Oup5GEsk5Y9p On5aNzo2pSxHgQedDzhvtK8qU6/DfTd2kIatLt6MLOfW 2hiNHkV7USRxDGH1bakxZoV8WpNW4QdPPZCv/luw4lHTnFY9/H/2fLT7kPg=&param=0fYm5t7d9pY=&rid=1961&s=??????? ?? ?????? - ?????? ??????????? (2014) ???????? ??? ????? ??????????? ?? 1 1 ?????? /.../ ????? ?????????? (2014) ????????&cs=UTF-8&u=&fu=

http://sub2.bubblesmedia.ru/sb/clk/s/1246/o/145/p/1249/.../zsr?a=1

http://sub2.bubblesmedia.ru/go/?link= 1nmLbJoKILgn1qzWV4B0lwLZ8aPFoE4V7Gn3xKF7oOH6Sa0RYc0N3RkSc9reezLOiM6baXfyxNCdK5AN4KiqnOdINMbR8EMiMmIzsDOQ2Xxy0E7gxK2b7Y2rgHnTnyiUEQUy8tKli87t/UmFG5WM9sETh3YvH4MgjhYOsMdvJouWh0UVVooOcXAcns=&param=yFrqVnS2gwc=&rid=1961&s=??????? ?? ?????? - ?????? ???? ????? (2014) ???????? ?????? ?????? ??? ????? /.../ ?????? ??????? ???????? ??? ?????&cs=UTF-8&u=&fu=

http://ld.mediaget.com/index2.php?l=tr&r=fulloyun.com&f=championship-manager-2003-2004-full-oyun-indir-download-ykle-full-oyun-indir-download&s=Championship Manager 2003-2004 - Full - Oyun indir - Download - Yükle - Full Oyun indir Download&bbls_client_id=55475301&bbl=1

http://ld.mediaget.com/index2.php?l=it&r=moddingtr.com&f=pes-2014-moddingtr-2014-stsl-super-patch-v20-u0130ndir-moddingtr-yamalari-patches-moddingtrcom-oyun-yamalaru0131oyun-haberleri&s=PES 2014 ModdingTR 2014 STSL Super Patch v2.0 - Indir | ModdingTR YAMALARI (PATCHES) | ModdingTR.com - Oyun Yamalari,Oyun Haberleri&bbls_client_id=54816810&bbl=1

http://mediaget.com/torrent.php?rid=1908&s=PES 2014 ModdingTR 2014 STSL Super Patch v2.0 - Indir | ModdingTR YAMALARI (PATCHES) | ModdingTR.com - Oyun Yamalari,Oyun Haberleri&r=moddingtr.com&f=PES 2014 ModdingTR 2014 STSL Super Patch v2.0 - Indir | ModdingTR YAMALARI (PATCHES) | ModdingTR.com - Oyun Yamalari,Oyun Haberleri&cs=UTF-8&u=&fu=&bbl=1&bbls_client_id=54816810

http://sub2.bubblesmedia.ru/go/?link=4yhNCZt9t7TvhEUF8Z5tT55O3zjAJMrHIgTgCAexkaSyF9KSaQvTCMCVa47b56DLQFNGbekOB/.../WIk=&param=SefBrOj4cLU=&rid=1908&s=PES 2014 ModdingTR 2014 STSL Super Patch v2.0 - Indir | ModdingTR YAMALARI (PATCHES) | ModdingTR.com - Oyun Yamalari,Oyun Haberleri&r=moddingtr.com&f=PES 2014 ModdingTR 2014 STSL Super Patch v2.0 - Indir | ModdingTR YAMALARI (PATCHES) | ModdingTR.com - Oyun Yamalari,Oyun Haberleri&cs=UTF-8&u=&fu=

http://ld.mediaget.com/index3.php?reinstall=true&bbls_client_id=56672109

http://mg.bubblesmedia.ru/index.php?redirect_url=http://.../index3.php?reinstall=true

http://ld.mediaget.com/index2.php?l=ru&r=pc-torrent.ru&bbls_client_id=57931003

http://mg.bubblesmedia.ru/index.php?redirect_url=http://.../index2.php?l=ru&r=pc-torrent.ru

http://torr.mediaget.com/torr.php?r=pc-torrent.ru

Latest 30 of 42 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to sw90.ua-hosting.company  (91.215.156.143:80)

TCP (HTTP):
Connects to customer.clientshostname.com  (185.104.10.56:80)

TCP (HTTP):
Connects to 163-172-220-89.rev.poneytelecom.eu  (163.172.220.89:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.