mp3rocket-win.exe

MP3 Support

The application mp3rocket-win.exe by MP3 Support has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from global-shared-files-l3.softonic.com and multiple other hosts. While running, it connects to the Internet address hosted-by.leaseweb.com on port 80 using the HTTP protocol.
Publisher:
MP3 Support  (signed and verified)

MD5:
210192501e358866a864a2202347ba25

SHA-1:
7c3b88f7ab8ad2d11bb5606b5540d7374e5b0657

SHA-256:
ede7707ca375bac2a925ab85af9ad26981d34b2db8cb71ad3a83d3360dae209b

Scanner detections:
8 / 68

Status:
Potentially unwanted

Analysis date:
11/19/2017 9:03:47 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Kryptik
7.1.1

Comodo Security
UnclassifiedMalware
18000

Dr.Web
Trojan.MulDrop5.10078
9.0.1.0103

ESET NOD32
Win32/Kryptik.BVVE (variant)
8.9672

Fortinet FortiGate
W32/Kryptik.BVVE!tr
3/27/2014

Qihoo 360 Security
Win32/Trojan.4bc
1.0.0.1015

Reason Heuristics
PUP.MP3Support.N
14.3.27.9

Trend Micro House Call
TROJ_GEN.F47V0324
7.2.86

File size:
649.8 KB (665,424 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\mp3rocket-win.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/26/2013 7:00:00 PM

Valid to:
7/11/2015 6:59:59 PM

Subject:
CN=MP3 Support, OU=SECURE APPLICATION DEVELOPMENT, O=MP3 Support, L=Oshawa, S=Ontario, C=CA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
146C2E323177663B9DF87FFF1B9C31D8

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:txnvp+jZLHFzQZInki9abZP1Rr7cbcOg8idBBKjfCUrfrMDTDD7W46oJ/dSWe:txnvcjXnR9abZtF7c+8iwf90764j/+

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mp3rocket-win.exe has been seen being distributed by the following 50 URLs.

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140626094921&nva=20140626215021&token=06f634fe2da804309f212&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140416140202&nva=20140417020302&token=0ddba9ceaf6ade2c29f08&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140618020246&nva=20140618140346&token=034f643fd541d21cfefa8&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140512032340&nva=20140512152440&token=0abc72e53cd4bc36c9939&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140611225528&nva=20140612105628&token=0b9aea54c068a098e4e6c&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://mp3-rocket-download.software.informer.com/.../

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140416122340&nva=20140417002440&token=0b0fe274992dfd7463f95&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140405210959&nva=20140406091059&token=03ae78d586dbdc2ee18d0&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140604185257&nva=20140605065357&token=0ecb30311d057e0e6ca2f&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140531112757&nva=20140531232857&token=060ad70f3baa41c23170a&id_file=54821&channel=WEB&instance=softonic_br&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140428215749&nva=20140429095849&token=024727dcff1547fd57f3a&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://nl.inncdn.com/download.php?os=&icon=aHR0cDovL2ltYWdlcy5ici5zZnRjZG4ubmV0L2JyL3Njcm4vNTQwMDAvNTQ4MjEvbXAzLXJvY2tldC0wMS0xMDB4MTAwLnBuZw==&desc=QmFpeGUgbyBxdWUgcXVpc2VyIGRhIHJlZGUgZGUgaW50ZXJjw6JtYmlvIExpbWVXaXJl&name=MP3 Rocket&domain=mp3-rocket&ss=&lang=pt_BR&url=aHR0cDovL21wMy1yb2NrZXQuc29mdG9uaWMuY29tLmJy&version=051114&ins=apportalbr&gclid=CPW33MmA9sECFetj7AodvxEAwA

Latest 30 of 59 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.155:80)

TCP (HTTP):
Connects to ec2-52-208-40-227.eu-west-1.compute.amazonaws.com  (52.208.40.227:80)

TCP (HTTP):
Connects to 50.115.122.45.static.westdc.net  (50.115.122.45:80)

Remove mp3rocket-win.exe - Powered by Reason Core Security