home

downloader_10924_i38079700_il345.exe

Runner Utility

BERSHNET LLC

The application downloader_10924_i38079700_il345.exe by BERSHNET has been detected as adware by 16 anti-malware scanners. This is a setup program which is used to install the application. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from downprov.brown1switch.com.
Publisher:
Dummy, Ltd.  (signed by BERSHNET LLC)

Product:
Runner Utility

Version:
1.0.0.186

MD5:
c1f081983d42fc2ee507f9eb14cdcbd3

SHA-1:
10711f046f0758093ecff568c2abb84a2a1810ba

SHA-256:
1d4b7a7df26fb3f0aef0e1b9234d90f54522e41051ee1359538d1fb19cf7c920

Scanner detections:
16 / 68

Status:
Adware

Analysis date:
4/19/2024 3:15:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8247
701

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.212.146

AVG
Win32/Heur
2016.0.3179

Bitdefender
Gen:Variant.Adware.Mikey.8247
1.0.20.325

Comodo Security
Application.Win32.LoadMoney.IARS
21220

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8247
8.15.03.06.05

ESET NOD32
Win32/Amonetize.DW potentially unwanted (variant)
9.11237

F-Prot
W32/S-59232acb
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey.8247
11.2015-06-03_6

G Data
Gen:Variant.Adware.Mikey.8247
15.3.25

K7 AntiVirus
Unwanted-Program
13.1915090

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.2389

Malwarebytes
PUP.Optional.Amonetize.A
v2015.03.06.05

MicroWorld eScan
Gen:Variant.Adware.Mikey.8247
16.0.0.195

Reason Heuristics
PUP.BERSHNET
15.3.6.5

VIPRE Antivirus
Amonetize
37930

File size:
1.5 MB (1,542,672 bytes)

Product version:
1.0.0.186

Copyright:
Copyright (C) 2013

Original file name:
runner.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\downloader_10924_i38079700_il345.exe

Digital Signature
Signed by:
BERSHNET LLC

Authority:
COMODO CA Limited

Valid from:
2/6/2015 1:00:00 AM

Valid to:
2/7/2016 12:59:59 AM

Subject:
CN=BERSHNET LLC, O=BERSHNET LLC, STREET="st. 600-richya b.66, of.10", L=Vinnitsya, S=Vinnitskaya, PostalCode=21027, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E2D6C6F8DDF832E09DCF766B299AD2A9

File PE Metadata
Compilation timestamp:
2/26/2015 3:53:08 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:0zbL+yLnb+xnKRJZBdDmfMannL0VDB9QD+Xrx6EjJAWwTSzvewVSee8XhYqIeFD:0zOyjb+xnAJ9Sf7AVnY+bx3amtVDF9J

Entry address:
0x2EBC45

Entry point:
60, 9C, C7, 44, 24, 20, FF, 90, CB, 82, E8, 8F, 4B, 01, 00, 2B, 0C, 0C, 91, 77, A2, 56, 1C, CD, 47, 0D, 30, 54, 1F, 06, FB, 17, 9A, 72, 2C, D9, FD, 08, 4B, F7, F7, 02, 54, A2, 68, 97, 5F, FE, 38, C4, A7, 62, F3, E6, 30, 3E, 60, B6, 86, 84, D0, E9, F2, 28, 28, 99, B7, EC, 13, 03, 20, 1A, 92, E8, D4, 64, E7, 02, 08, 0F, 07, C3, 3E, 69, 9D, EF, 10, E5, 2B, B2, 56, 7F, 75, D0, 13, F2, 31, C3, 65, 39, 5E, 56, 78, 8B, 70, A0, 27, C7, A6, 8D, 94, AF, CF, A1, 28, D2, B9, 02, D9, AE, 62, 5B, 91, 66, 21, A9, 29, 3C...
 
[+]

Code size:
99 KB (101,376 bytes)

The file downloader_10924_i38079700_il345.exe has been seen being distributed by the following URL.

http://downprov.brown1switch.com/direct?version=1.1.8.22&campid=10924&instid[appname]=Downloader_Downloader&instid[appsetupurl]=http://go.bestsoftwarelive.com/getfast/download.cgi?9&ti1=3170000&ti2=0&ti3=2015-02-26T15:03:12.887201 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.bestsoftwarelive.com/d1/logo150x150.png&prefix=Downloader&instid[thankyoupage]=http://download.bestsoftwarelive.com/.../thank_you.php?ti1=3170000&ti2=0&ti3=2015-02-26T15:03:12.887201 00:00&parameter=Downloader&instid[interrupted]=http://download.bestsoftwarelive.com/.../interrupted.php?ti1=3170000&ti2=0&ti3=2015-02-26T15:03:12.887201 00:00&parameter=Downloader&ti1=3170000&ti2=0&ti3=2015-02-26T15:03:12.887201 00:00&_dest=files.blaster-online-3.in

Remove downloader_10924_i38079700_il345.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.