setup.exe

TowerTilt

This is the installer and setup program from the TowerTilt branded Yontoo adware web browser extension. This adware injects various forms of advertisements in the user's web browser based on the HTML content and URLs viewed. Ad include banners, in-line context text links, coupons, and search. The program will install an auto-updating background service that will update the software with additional features. The application setup.exe by TowerTilt has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Remove setup.exe - Powered by Reason Core Security
Publisher:
TowerTilt  (signed and verified)

MD5:
6aa8119730d3ae456b9cf5afb5e71335

SHA-1:
89fccad5f7d8d5c4b14d2bd65341b1e86f32993d

SHA-256:
74fe6ead02b6044e1a2536715cfe41d3b89d954b9c1ca306d80f15cede8c58ec

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
12/4/2016 9:23:00 AM UTC  (today)

Scan engine
Detection
Engine version

Antiy Labs AVL
Trojan/Win32.TSGeneric
1.0.0.1

AVG
BrowseFox
2015.0.3448

Dr.Web
Trojan.BPlug.17
9.0.1.0161

ESET NOD32
Win32/BrowseFox (variant)
8.9918

Malwarebytes
PUP.Optional.TowerTilt.A
v2014.06.10.09

McAfee
Artemis!EAD6FF53A1B1
5600.7104

Reason Heuristics
PUP.Installer.TowerTilt.F
14.6.10.9

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF
23.00.65.14608

SUPERAntiSpyware
Adware.BrowseFox/Variant
10552

Trend Micro House Call
TROJ_GE.31395C52
7.2.161

VIPRE Antivirus
Yontoo
30126

Remove setup.exe - Powered by Reason Core Security
File size:
2 MB (2,119,368 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
2/4/2014 3:00:00 AM

Valid to:
2/5/2015 2:59:59 AM

Subject:
CN=TowerTilt, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TowerTilt, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0DC21B60DDFB723E55B2F05376083F29

File PE Metadata
Compilation timestamp:
12/6/2009 1:52:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:JGO48Uz0g+O8M/lCYmm0z00B1zm/cxU58d:oGUz0rPsl1QndTUSd

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 6F, 44, 00, E8, F1, 2B, 00, 00, A3, 84, 6E, 44, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, 9C, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 2E, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, F0, 46, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9977

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to wac.edgecastcdn.net  (72.21.81.13:80)

TCP (HTTP):
Connects to service.yontoo.com  (8.25.35.148:80)

TCP (HTTP):
Connects to api.yontoo.com  (8.25.35.15:80)

Remove setup.exe - Powered by Reason Core Security