home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 28 anti-malware scanners. The file has been seen being downloaded from lax1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
41fe2b6ba1c86554aa42dfa3ada1da0c

SHA-1:
b1a1c01d8b9083a70d8e8993a7522c4d9791b565

SHA-256:
54f4e6e3b5396bd8de17caebcd3b30f6d93dc8ae5e3aa0d002f436f26d9faaf0

Scanner detections:
28 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/19/2024 10:42:49 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140913

Baidu Antivirus
Hacktool.Win32.Downloader
4.0.3.14913

Dr.Web
Adware.Downware.5822
9.0.1.0256

Fortinet FortiGate
Riskware/Agent
9/13/2014

G Data
Win32.Trojan.Agent.4P134N
14.9.24

herdProtect (fuzzy)
variant of setup(2).exe (Adware)
2014.11.9.11

IKARUS anti.virus
Trojan.Win32.Agent
t3scan.1.6.1.0

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3258

McAfee
Artemis!17FD46A07B73
5600.7009

Panda Antivirus
Trj/Chgt.F
14.09.13.10

Qihoo 360 Security
Win32/Virus.Downloader.8e5
1.0.0.1015

Quick Heal
Downloader.Agent.r3 (Not a Virus)
9.14.14.00

Reason Heuristics
PUP.Installer.Stepitapp.F
14.9.13.10

Trend Micro House Call
TROJ_GEN.F47V0516
7.2.256

Vba32 AntiVirus
Downloader.Agent
3.12.26.0

VIPRE Antivirus
Conduit
33046

File size:
404.6 KB (414,264 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 6:00:00 PM

Valid to:
12/11/2014 5:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
9/10/2014 2:43:35 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:bP8mDLCDibqI59PpOPf201/z7pUmJI9ftRVlYmr7n:gmDODibqI59Pk2cb7pUmJ0ftRVljfn

Entry address:
0x62EAE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1441

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
388 KB (397,312 bytes)

The file setup.exe has been seen being distributed by the following 28 URLs.

http://lax1.ib.adnxs.com/click?ev11bdElsD9EkHDnefeqP7gehetRuK4_RJBw53n3qj96_XVt0SWwP0-hMccvW5seJpSDviteIXQVZx9UAAAAAGImLgDIAQAAdgIAAAIAAADxzysBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAArd0AAgUAAQIAAJIAEii6DgAAAAA./cnd=!rgapPwjQ9JMCEPGfrwkY87IWIAE./referrer=lax1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CKaojvS7xdeQdBACGM_Cxrn85dbNHiINNjkuNzYuMjIxLjIzMSgBMJXO_aAF&tag=3024482

http://lax1.ib.adnxs.com/click?z9lf-m6X1z9UeaVBUu_TP6JFtvP91Ow_VHmlQVLv0z_P2V_6bpfXP_51naLS2PQ5AuOMGIYuJQoX0BRUAAAAAFxmNAA_AQAAdgIAAAIAAACCqB0BHvEGAAAAAQBVU0QAVVNEACwB-gBz9AAAlN0AAgUAAQIAAJQAmCupdgAAAAA./cnd=!hAZxPQjtqq4CEILR9ggYnuIbIAA./referrer=www.driversupport.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CILGs8Th0MuSChACGP7r9ZSqmrb6OSIONjguMjI4LjE2Ny4xNDcoATCXoNOgBQ..&tag=3434076

https://secure-nym.adnxs.com/click?gCgOIVnyvz_9-GpGOMK4PwAAAAAAAPA__fhqRjjCuD-BKA4hWfK_P8Pz9PieVkosw-3Y3JiqdX8_MhNUAAAAANN4NAByBwAAdgIAAAIAAABN7vUAqIUHAAAAAQBVU0QAVVNEANgCWgCOrwAAwasAAgUAAQIAAJQARSjccAAAAAA./cnd=!TQabPAjCzJMCEM3c1wcYqIseIAE./referrer=www.youtube.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMPb4-aN0-q6fxACGMPn08fv05WlLCINMTg0LjMuMTM4LjE0NigBML_kzKAF&tag=3438803

http://lax1.ib.adnxs.com/click?2yCDiiHmxz8JVdGvo_TDP-xRuB6F67E_CVXRr6P0wz_bIIOKIebHP5mxxr2P8W99w6CBxfx5bi7rHxpUAAAAAGImLgDIAQAAdgIAAAIAAABx_SkBc5kFAAAAAQBVU0QAVVNEANgCWgClXQAACrsAAgUAAQIAAJIACSuyKQAAAAA./cnd=!AQecQgjQ9JMCEPH6pwkY87IWIAE./referrer=soft81.net/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CMPBhqzMv563LhACGJnjmu77sfy3fSIONzAuMTk1LjE5NS4yMzUoATDrv-igBQ..&tag=3024482

https://secure-lax.adnxs.com/click?6Lt_DNwzyT-AVjKATQvFP_Q9B7oLXe0_gFYygE0LxT_ou38M3DPJP52Fp5rq1u9996xs4VsKKw7GsxVUAAAAAGImLgDIAQAAdgIAAAIAAAAQDikBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAMLsAAgUAAQIAAJIAsyV5QwAAAAA./cnd=!GQYXOQij27QCEJCcpAkY87IWIAA./referrer=secure.imp-serving.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPfZsou-y8KVDhACGJ2LntWp3fX3fSINNTAuMTYxLjkyLjE5MCgBMMbn1qAF&tag=3024482

http://nym1.ib.adnxs.com/click?AsRxENjAwz86RkD5dn7APzvfT42XbrI_OkZA-XZ-wD8DxHEQ2MDDP5IOs5HOJxoFkfdn81FS6Bvb0hlUAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAgLEAAgUAAQIAAJIAHydmfgAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=nym1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJHvn5ufypT0GxACGJKdzI3p-YmNBSIPMTA0LjEzOC4xMTYuMTQyKAEw26XnoAU.&tag=3024482

http://nym1.ib.adnxs.com/click?upZ-Tv6X2T_x2Pt0mEbRP_7UeOkmMdg_8dj7dJhG0T-7ln5O_pfZPw1ACwWmPBx8gJ3p1MuayhGfOBNUAAAAAKy3MwBNBQAAdgIAAAIAAADUTwQBqyQHAAAAAQBVU0QAVVNEANgCWgC_lQAAkccAAgUAAQIAAJQAZytodAAAAAA./cnd=!UgY9PQjo0KsCENSfkQgYq8kcIAA./referrer=http://www.doctoroz.com/topic/fast-fixes-every-body/clickenc=http://nym1.ib.adnxs.com/click?5Inm1ZE1uT9r52xgLeiyP0jhehSuR-0_a-dsYC3osj_liebVkTW5P7J5jVUyj6VMgJ3p1MuayhGcOBNUAAAAAKaLNQBaCQAAKAoAAAIAAAAMNB4Bx0QGAAAAAQBVU0QAVVNEANgCWgDX2wAABeIDAQUAAQIAAI4ArykUyAAAAAA./cnd=!Qgb8OgiexLACEIzo-AgYx4kZIAA./referrer=http://www.doctoroz.com/topic/fast-fixes-every-body/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIC7pqe92ablERACGI2ArajglI-OfCIMOTkuODkuMTIyLjk0KAEwn_HMoAU.&tag=3389356

http://nym1.ib.adnxs.com/click?IGdUP-vsSkAgZ1Q_6-xKQAAAAAAAQFRAIGdUP-vsSkAgZ1Q_6-xKQBjtzKSK83odLTuIuK9BjEvheChUAAAAABEsIgB2AgAAdgIAAAIAAAB-hyoBuIYFAAAAAQBVU0QAVVNEANgCWgABYQAAl6UAAgQAAQIAAIwAkiEihAAAAAA./cnd=!AQawOQip24wCEP6OqgkYuI0WIAQ./referrer=http://www.download366.com/coreldraw/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CK32oMT7tZDGSxACGJjas6aq8by9HSIMNjUuMzQuMTU5LjQ0KAEw4fGhoQU.&tag=2239505

http://nym1.ib.adnxs.com/click?FitCaEWBvj-oK4nLvXi5P-xRuB6F67E_qCuJy714uT8WK0JoRYG-P0U6MLC8XCY2aBL2OQpGuQJ30yVUAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAJqkAAgUAAQIAAJIA3SP9hwAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=nym1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COik2M-jwdHcAhACGMX0wIHLl5eTNiILNzQuNjcuMTUuMTcoATD3ppehBQ..&tag=3024482

http://ttb.allsoftpc.com/download/request/.../FodUQ1SG?ClickID=4a53be15c6c28c3d2203c04dc0689337&PubID=CD5917

http://nym1.ib.adnxs.com/click?rluk08OC0D9tUfaMspLLP5zEILByaLE_bVH2jLKSyz-uW6TTw4LQP5WL7lzIoPwsqS4A3t0EdVUhIBtUAAAAAGImLgDIAQAAdgIAAAIAAADxzysBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAJrMAAgUAAQIAAJIANir0CAAAAAA./cnd=!rgapPwjQ9JMCEPGfrwkY87IWIAE./referrer=ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKndgPDdm8G6VRACGJWXuueFmaj-LCIONzIuMTc5LjE2Ni4xODgoATChwOygBQ..&tag=3024482

http://nym1.ib.adnxs.com/click?N8SAdCxlsj-4HoXrUbiuP7gehetRuK4_dmXky_OlxD8AHFtZe7rIPzO_juRILEBpvjCLg9QL-yFt6R5UAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAA9uEAAgUAAQIAAJIAfiip6gAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CL7hrJzI-sL9IRACGLP-uqSOiYugaSIMNjguMzIuMTgxLjM3KAEw7dL7oAU.&tag=3024482

http://nym1.ib.adnxs.com/click?qIGs-H-9vj_iSh_H3NK3PwAAAAAAAPA_4kofx9zStz-ogaz4f72-P5fMjgncSgcktr5f5Uz66CJVcBRUAAAAAMF5NAByBwAAdgIAAAIAAABN7vUAvYUHAAAAAQBVU0QAVVNEANgCWgA9sAAA7eUAAgUAAQIAAJQAbCrofAAAAAA./cnd=!YgYEPQjCzJMCEM3c1wcYvYseIAE./referrer=www.poptropica.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLb9_qrOyb70IhACGJeZu8zA29KDJCIOMjA3LjE0NC4yMTcuMjcoATDV4NGgBQ..&tag=3439041

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJCt_o2h86TKBRACGI2hzKnv7t2veyIPMTYyLjIxMC4xMjUuMTM5KAEwqJX4oAU.&tag=3024482

http://nym1.ib.adnxs.com/click?F6xtU-cTuz8jLZW3I5y2P7gehetRuK4_dOhsAGXGuT-9yR7XRN6-P40QM_V2d197kJa_EZqTlAWoCh5UAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAA3bAAAgUAAQIAAJIAzibuVgAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=an-imp.bid.ace.advertising.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJCt_o2h86TKBRACGI2hzKnv7t2veyIPMTYyLjIxMC4xMjUuMTM5KAEwqJX4oAU.&tag=3024482

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPP6wP6w4MPfcBACGNWCnZ7WoNLHPyIMMjQuMjEuNTAuMTc4KAEw4sfYoAU.&tag=2239505

http://lax1.ib.adnxs.com/click?YgPs8YgPUUBiA-zxiA9RQAAAAAAAAFBAYgPs8YgPUUBiA-zxiA9RQFVBx2MFSY8_cz3QDwMPv3DiIxZUAAAAABEsIgB2AgAAdgIAAAIAAABN7vUAuIYFAAAAAQBVU0QAVVNEANgCWgABYQAAJa0AAgQAAQIAAIwA7h7XoQAAAAA./cnd=!Ogb4OgiW3o0CEM3c1wcYuI0WIAQ./referrer=http://www.download366.com/chuzzle/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPP6wP6w4MPfcBACGNWCnZ7WoNLHPyIMMjQuMjEuNTAuMTc4KAEw4sfYoAU.&tag=2239505

http://flv.atappz.com/n/3.1.1/.../Setup.exe

http://flv.atappz.com/n/.../Setup.exe

http://1.track234e6.com/d/.../1675--1349--1393979806.0814--2c281c9081

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMeQ99an967mExACGPuj7Zqx-6LXcCINNzUuMTMxLjIzLjI0NSgBMJCgnKEF&tag=3556721

https://secure-nym.adnxs.com/click?st85NUQwwD9TtBnsnBe5PwAAAAAAAPA_U7QZ7JwXuT-x3zk1RDDAP_tRWxPbi65wR8jderq7zBMQECdUAAAAAHFFNgByBwAAdgIAAAIAAAB-hyoBqIUHAAAAAQBVU0QAVVNEANgCWgCOrwAALecAAgUAAQIAAJQAUyOkAwAAAAA./cnd=!BQZtOgjCzJMCEP6OqgkYqIseIAE./referrer=secure.static.tumblr.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMeQ99an967mExACGPuj7Zqx-6LXcCINNzUuMTMxLjIzLjI0NSgBMJCgnKEF&tag=3556721

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CL2Wydyc3a3YaBACGIyrzdn_y4T2OSIMMjMuMjQzLjQ5Ljc0KAEw5_qBoQU.&tag=3024482

http://lax1.ib.adnxs.com/click?FCLh4h6Loz9MoOwRm1GgP7gehetRuK4_TKDsEZtRoD8UIuHiHoujP4xVM_tfEuw5PUuSy-m2sGhnfSBUAAAAAGImLgDIAQAAdgIAAAIAAABx_SkBc5kFAAAAAQBVU0QAVVNEANgCWgClXQAAUN0AAgUAAQIAAJIAwCYUYAAAAAA./cnd=!AQecQgjQ9JMCEPH6pwkY87IWIAE./referrer=ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CL2Wydyc3a3YaBACGIyrzdn_y4T2OSIMMjMuMjQzLjQ5Ljc0KAEw5_qBoQU.&tag=3024482

http://lax1.ib.adnxs.com/click?VUCzk4SwwD88ePDXGt-7P7gehetRuK4_PHjw1xrfuz9VQLOThLDAP62V1YH6228Uv4MbJ3KNkTHkmyFUAAAAAGImLgDIAQAAdgIAAAIAAABx_SkBc5kFAAAAAQBVU0QAVVNEANgCWgClXQAABcUAAgUAAQIAAJIAdSmLoAAAAAA./cnd=!AQecQgjQ9JMCEPH6pwkY87IWIAE./referrer=www.omnitrans.org/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CL-H7riiruPIMRACGK2r1o6o__a3FCINMTA4LjAuMTYzLjE1NigBMOS3hqEF&tag=3024482

http://lp.downloads-videos-free.com/.../setup.exe

http://lax1.ib.adnxs.com/click?i8KOtskKyz8qAYQmh5TGP5zEILByaLE_KgGEJoeUxj-Lwo62yQrLPyy6uvcMoFAXelzV7feolHlDGBtUAAAAAGImLgDIAQAAdgIAAAIAAADxzysBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAM60AAgUAAQIAAJIA7SY8fwAAAAA./cnd=!rgapPwjQ9JMCEPGfrwkY87IWIAE./referrer=www.dicetower.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPq41e7-nqrKeRACGKz06r3PgaioFyINNjguMTA2LjIxMS4yMigBMMOw7KAF&tag=3024482

http://www.downloadju.com/direct/.../setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.