home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 11 anti-malware scanners. The file has been seen being downloaded from lax1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
8a2ed863690c3ec7c5df4655583542d4

SHA-1:
a4dddcd333ea2732a3da0cbb268e82815bc7265a

SHA-256:
5cdb31e4a305bb62b7ccacdb85c1f42825283f8a3be7b2f3414fd02e37794542

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/25/2024 10:21:30 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140710

Fortinet FortiGate
Riskware/Agent
6/30/2014

herdProtect (fuzzy)
variant of setup(3).exe (Adware)
2014.8.30.0

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3631

McAfee
Artemis!8A2ED863690C
5600.7083

Panda Antivirus
Trj/Chgt.A
14.06.30.06

Qihoo 360 Security
HEUR/Malware.QVM03.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Stepitapp.F
14.7.17.10

Trend Micro House Call
Suspicious_GEN.F47V0620
7.2.181

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
30702

File size:
395.4 KB (404,912 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 7:00:00 PM

Valid to:
12/11/2014 6:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
6/14/2014 9:31:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:DgzFK8gCXibqI59PpOPf201/z7pHmJI9ftRClj3qS7o:DgcSXibqI59Pk2cb7pHmJ0ftRCljho

Entry address:
0x60E8E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1884

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
380 KB (389,120 bytes)

The file setup.exe has been seen being distributed by the following 6 URLs.

http://lax1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fP2ZmZmZmZgZAqxxaZDvf3z8zMzMzMzPjP_dtFqBi-MlRhUSZRFpWYWTpjrBTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAV74AAgUAAQIAAJAAAiUNJAAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.southwest.com/account/login/reset-password?token=6ea3c0c7dfe04d4ba75a977a77ee8b39/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIWJ5aSky9WwZBACGPfb2YCqjP7kUSINNzIuMjIyLjE0MS4yMygBMOmdwp0F&tag=2746637

https://secure-nym.adnxs.com/click?L94du7oNwT_8sdRu4W66PwAAAAAAAPA__LHUbuFuuj8v3h27ug3BP69DqxDqbcgItcCzgTp520Igha1TAAAAAOINLwByBwAAdgIAAAIAAABN7vUA_54GAAAAAQBVU0QAVVNEANgCWgDejQAANakAAgUAAQIAAJAAvCjd3gAAAAA./cnd=!MAeyQwif5_sBEM3c1wcY_70aIAA./referrer=www.softonic.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLWBz42op97tQhACGK-HrYWhvZvkCCIONjcuMTczLjEwMy4xMjcoATCgiradBQ..&tag=3083746

http://nym1.ib.adnxs.com/click?Lorg7IBx-D99PzVeukn0P30_NV66SfQ_mpmZmZmZAEAAAAAAAAAEQJPN0OoShMFQP14bxkNmA3I4pLBTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAGbMAAgUAAQIAAJIA1yPjcQAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=260&clientId=ae2339e1-dbe8-425e-822e-40c941a04b84&l=http://malware7.enigma.safecart.com/spyhunter2/download"&r=http://malwarebytes.download-pc-software.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CL-87bC8yNmBchACGJObw9auguHgUCINNzAuMTI3LjIyMS44NygBMLjIwp0F&tag=3087481

http://nym1.ib.adnxs.com/click?JI5v9jBe-D8EjQXhsjn0Px-F61G4HvM_mpmZmZmZAEAAAAAAAAAEQGry24Q-sfo8BVUKOtZ2XQSf9q5TAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAA_agAAgUAAQIAAJIA2CSbcQAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=39,101,107&clientId=b917b614-94e6-4c1d-9ba9-79c325ef5d97&l=http://www.nydailynews.com/&r=/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIWqqdDj2t2uBBACGOrk76bop6z9PCIMNjcuMjQ5LjExOS4zKAEwn-27nQU.&tag=3087481

http://nym1.ib.adnxs.com/click?e8hlxUAJ9z8fhetRuB7zPx-F61G4HvM_TUJ9ZnVc_z9UyDK8a-QCQIVjU9ihh0cAnT0jr7SOwWhgQK9TAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAADbMAAgUAAQIAAJIA0SbYdAAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=289&clientId=deb4cafb-83d8-49b5-8257-d3d83e41fce1&l=http://criticalsoftwarepatch.com/tri/ufpj52874/?subid=22693a1d8943444387ba5a5dd971ef55&subid2=923&subid3=73907&transaction_id=2ca7e540-0c5e-4767-8a59-3500b8ccbe32&rand=53af406c6e674&source=eeeeeejavaus&entry=y&clear=y&r=http://ebdr3.com/server?st=1&cb=656232&ebdr_sid=(null)&pid=923&zid=73907&aid=871592&cid=156461&noc=0&opt_params=(null)&click=&rc=(null)&ohname=http://www.opera.com/.../thanks?partner=www&no_ssp=(null)&final_url=opera.com&final_site_id=900738591&t_url=http://www.opera

http://nym1.ib.adnxs.com/click?e8hlxUAJ9z8fhetRuB7zPx-F61G4HvM_TUJ9ZnVc_z9UyDK8a-QCQIVjU9ihh0cAnT0jr7SOwWhgQK9TAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAADbMAAgUAAQIAAJIA0SbYdAAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=289&clientId=deb4cafb-83d8-49b5-8257-d3d83e41fce1&l=http://criticalsoftwarepatch.com/tri/ufpj52874/?subid=22693a1d8943444387ba5a5dd971ef55&subid2=923&subid3=73907&transaction_id=2ca7e540-0c5e-4767-8a59-3500b8ccbe32&rand=53af406c6e674&source=eeeeeejavaus&entry=y&clear=y&r=http://ebdr3.com/server?st=1&cb=656232&ebdr_sid=(null)&pid=923&zid=73907&aid=871592&cid=156461&noc=0&opt_params=(null)&click=&rc=(null)&ohname=http://www.opera.com/.../thanks?partner=www&no_ssp=(null)&final_url=opera.com&final_site_id=900738591&t_url=http://www.opera

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.