home

setup.exe

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 9 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.downanapp.com and multiple other hosts.
Publisher:
Stepitapp LLC  (signed and verified)

MD5:
3e1ec10766413c17cbf9d0145a9ce3d8

SHA-1:
8dda5840fb0c6f82e4ebefd5770d22ff5e0c17c2

SHA-256:
03dca726a8181599cc464a1d850236e3c0d51705f35c665057c0bb1c92b03dab

Scanner detections:
9 / 68

Status:
Adware

Analysis date:
4/25/2024 3:30:29 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dldr.Agent.216048
7.11.201.138

avast!
Win32:Dropper-gen [Drp]
2014.9-150129

ESET NOD32
Win32/Downloader.Agent.AI (variant)
9.11021

McAfee
Artemis!F4CD8201B97A
5600.6871

Reason Heuristics
PUP.Installer.Stepitapp.F
14.12.31.10

Sophos
Generic PUA OF
4.98

Trend Micro House Call
Suspicious_GEN.F47V1214
7.2.365

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
36688

File size:
211 KB (216,048 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/11/2013 1:00:00 AM

Valid to:
12/12/2014 12:59:59 AM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
12/11/2014 11:09:08 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:Dbm6l7b9RZtLiNZsWFel4UDP5i/7VgmpW7+oJ0y8FIPCgHRwz:Db7l7b9zt+No4G5+Vg6W7+oJmIP1G

Entry address:
0x145C1

Entry point:
E8, CA, 6B, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 14, 75, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, A4, 70, 42, 00, C9, C2, 08, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81...
 
[+]

Code size:
151 KB (154,624 bytes)

The file setup.exe has been seen being distributed by the following 6 URLs.

http://www.downanapp.com/.../300?sub_id=w9yUDAK6ZaMN6fzOOdH5nP8wU5a26kbUNBGWBA5HUidc0sIQiII_5BqQDYpqf2JvCRwNqxKEQNqSpAJK8uq1QhCZGsTVVJEjSy9tVJdeIbH1P-FvhmRL0HZEZoqjz9O86fEetGxNIsn8kEPUfgyDc7a6xVXLikm4EpzQ5NAZ4Phpr2zV8M-7zRBeRbIXt4ktXAddXIqwtCAsU0KOJvGr_8zdEF4hbpqHKeRE-hKqDxXwK_BjDYr4Y_38G4sOD2sOFi1X6dHD_E82r9d-Knm7yK2qOMDf4FSwdb64vnpj-3EVvEInGYAMbKHlRXrPXTlZ3hd1NMqPLbhmwIMnKO9Wo3aOQtTRJQ6h9uPT1Aoxz_nbdzhZ4kp-umulHfBNKbm67JUzuxT6-DY4otmvluHpH34M&pub_id=300&template=lp8

http://www.downanapp.com/.../300?sub_id=jSSgV_PUYg2-EcORwYDskbh8REOnBCpqWeVslJjkKenR1wq5j0cKQx3__do4IhT9OYx1Ad30EG2din__zqCId--0t3AZLS2uca1pu_dHj7YG1lqrZj7IE-St_xhasBiZK_LqB9YmgJx2Zb5yjkSMBEn_sDXfrr8eblQAvbyfXAu6WYHIbAib-e5JVYF3Y-zKz2JLFGi1uc0_HRtUvm0f-84i7LWPRqo_982i0-0PibIoZsQHABoPGq4w656vXm3ACgamQzg1rTJa_4GGRjb8Wc1SXpuo4pBFyYqgbLXKic6ai03u6mlb9dDL5RukXeTwN8niuFbd9O5f9OHJQGaRI0jpR7F3BDDMdk6tsk9in3anyhgJ6jkXfKdtCTth5LIbbA3iri3Dq6rUtc6f33ctA5E63QisE2GdSiE4F5hlpKBt&pub_id=300&template=lp4

http://www.downanapp.com/.../300?sub_id=elH8I_6BFdGauYBMB9J5MYzPhbW2_z0Sm1JY51rJhdrqiPvUfM1Vr8zbO1N5p4fIHxsLCiUbsWyvJU3DJ8B7s4v2rBBcRB9TpMLOavVek280hsc0_hLM7SBZjeL-mzMbPhVyOUOh5F_FVHds_UTuqaLAQeBmQyWsxiEW8dyz9L4IA1Rt-b44Hb7yPcx2Yw8pJnVxXe08Ol-rOLYn4psZTjqvCrIzeu7v7_iP6pZ9V_jHogQ65lPRvjYVQ3Eicptdkq5MYcXCKQY35kKh6B8m2s6YwkoN7IE7Ui1hfGFq0LGiygWyleKi5GH7sLecarHGY3CK0l4--XSuGdfCjgwGLremwwGA7aZy8EnjGArAUbKQ_SrwPAjvAEFrfJ8QBsUt5nTrTcZ449jPvUrkwvKSMZFAFBb_c5a04gl-3lypw99TXD8&pub_id=300&template=lp4

http://www.downthat.com/.../2?sub_id=HprcDoiKYHtuY2M0s_idEsLdFjMh62y4746uLtJ9-Adz8JapsZF8-PKtfsdbgxK8786gWNAuP-bTkWwDWG62BeRSnaliJKTcPd5I9snOEXqcHaek94iGCrz4FrMD4XIgQXYCjUCnZtk1mMaOecMCaFLvS1536hm8b_-ao_MMo6UIvtG8IK4Ofi9IOUH5CjoUa284x1aIKeyMgpvrwjTdrfJHv3ZCWJmLgITJi2HH6gpFWAniFEHCZAr8BrLmv7jkz1Kf5QaM2KwYj2LGtmB7_wurCpv2YdZTQ-bKzWa_WqZ-SdUddup4G_WSok7Iy2NXcPw3j0AYTSlC3eOghEA3YLW4zMwvGyr2PfXzpMEHkAD9edCgqzowJ59ymNF0vBcJLgnnGjS6Yn0tv-QxUZZm2SLNGueI-90K7tRy8PBcUKX9pMM&pub_id=300&template=lp4

http://aihdownload.adobe.com/bin/.../install_reader10_fr_mssd_aaa_aih.exe

http://www.downanapp.com/.../300?sub_id=m48C9OUCHKSK29OQ1UCKQIV3qkpeFZqQxiu7Uf1yCYULVZmsSH6IYZDH4khL_dBGaJrVWKTmx3-mrS7c7oZXwpOZVabyzrgGug2g-j4E-a-Q3vdrUStWa23kXFRKJMAdu7oT4oy3pZPR2Jnf1rrIzxJ7wtSXTEsl2YJB4O6QP2Ct4aPZG8XKx1y80ShdhDm1JRrjoLQSXokmrNwmDrNB7bYY_Vp5sgNCgntTlRdcOelia09NXZMBFcFscAKQ4O6ltfGoaXVU09eW7xUZvbB0l7u_0mx3PhqaU8uWOas3jxna-PWQbfMigBpe7EK2JKfs6bYzazxhbm-mA28B5w2aPw5tf09F-8IJ4cqvuuA6DXxEg-CsJ2iSmH4x9VcQ7acIPA_dEkH3RzqTVNFlWnczFb1uy_f4OpiDNU4Dqj0&pub_id=300&template=lp8

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.