home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 27 anti-malware scanners. The file has been seen being downloaded from www.yupdownload.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
afe8a7df77e4ed545be796aaa0d0749a

SHA-1:
bb1ab8c4dfd45897e52297ff209c204859922ef4

SHA-256:
d109bce775d15a53e18116f6edabe3d1b80395847c75cccf668602fa3c24a696

Scanner detections:
27 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/27/2024 4:19:25 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140920

Baidu Antivirus
Hacktool.Win32.Downloader
4.0.3.14920

Dr.Web
Adware.Downware.5822
9.0.1.0263

Fortinet FortiGate
Riskware/Agent
9/20/2014

G Data
Win32.Trojan.Agent.4P134N
14.9.24

IKARUS anti.virus
Trojan.Win32.Agent
t3scan.1.6.1.0

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3221

McAfee
Artemis!17FD46A07B73
5600.7001

Panda Antivirus
Trj/Chgt.F
14.09.20.05

Qihoo 360 Security
Win32/Virus.Downloader.8e5
1.0.0.1015

Quick Heal
Downloader.Agent.r3 (Not a Virus)
9.14.14.00

Reason Heuristics
PUP.Installer.Stepitapp.F
14.9.20.17

Trend Micro House Call
TROJ_GEN.F47V0516
7.2.263

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
33212

File size:
405.1 KB (414,776 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 6:00:00 PM

Valid to:
12/11/2014 5:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
9/10/2014 2:32:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:K1M5wPX7CibqI59Pk2cb7pUmJ0ftRdlZz7:K1M5wP7CibqIjk2cvpUmJ0vdlZz7

Entry address:
0x6312E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1407

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
388.5 KB (397,824 bytes)

The file setup.exe has been seen being distributed by the following 15 URLs.

http://www.yupdownload.com/trace?offer_id=16526&aff_id=11156

http://fra1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAEjhehSuR_8_AAAAAAAAAAAAAAAAAAAAAL2vt9ZkEkJDatQbbXdgjm-WsiFUAAAAACuGGQB2AgAAdgIAAAIAAABx_SkBhU0EAAAAAQBVU0QAVVNEANgCWgCVYgAAqIwAAgQAAQIAAIgAKReb9AAAAAA./cnd=!4wZ4RQji5PsBEPH6pwkYhZsRIAQ./referrer=http://www.ziveprenosy.cz/2014/09/real-madrid-elche-primera-division-watch-live-online-stream-zive-prenos-football-fotbal-23-9-2014-2000-september-soccer-match-sledovat-dnes-zdarma-football-internet-watch-free-today-broadcast-www-z//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=fra1COqo7-j2jpjHbxACGL3f3rXNzIShQyIOOTIuMjM5LjE4OS4yMzIoATCW5YahBQ..&tag=1672747

http://nym1.ib.adnxs.com/click?n1oP4xJh3D8rXaq_7CfTPwAAAAAAAPA_K12qv-wn0z-fWg_jEmHcP2tAiXBKv5FbBLQB8upziC2uDihUAAAAAFFnNgBNBQAAdgIAAAIAAADNTwQBDq4EAAAAAQBVU0QAVVNEACwB-gBt9QAA17QAAgUAAQIAAIgA9iIh5gAAAAA./cnd=!NwaUPAjo0KsCEM2fkQgYjtwSIAA./referrer=http://www.ncl.com/bge/home/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CITohpCv_ZzELRACGOuApYSn6e_IWyIOMTA0LjUwLjE3Mi4xNzAoATCunaChBQ..&tag=3565393

http://lax1.ib.adnxs.com/click?4CBGK578yD9HJiP7YF3DPwAAAAAAAPA_RyYj-2Bdwz_gIEYrnvzIPxyCfAMwiuodHVBwq_aHhBe72xFUAAAAALd5NAByBwAAdgIAAAIAAABN7vUAvYUHAAAAAQBVU0QAVVNEANgCWgA9sAAAo60AAgUAAQIAAJQAGSQWCgAAAAA./cnd=!YgYEPQjCzJMCEM3c1wcYvYseIAE./referrer=srv.quikdisplay.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CJ2gwdvq_qHCFxACGJyE8puAxqL1HSIMNzYuMjIuMjAuMjA3KAEwu7fHoAU.&tag=3439031

http://lax1.ib.adnxs.com/click?eLgBKQyxUUB4uAEpDLFRQAAAAAAAAFZAeLgBKQyxUUB4uAEpDLFRQJwJoRRmE6gbyVcdT1T2HmZ8eCNUAAAAABEsIgB2AgAAdgIAAAIAAAB-hyoBuIYFAAAAAQBVU0QAVVNEANgCWgABYQAA0sEAAgQAAQIAAIwA7RttTAAAAAA./cnd=!AQawOQip24wCEP6OqgkYuI0WIAQ./referrer=http://www.download366.com/call-of-duty/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CMmv9fjEyr2PZhACGJyThKXh7ITUGyIONTAuMTY4LjI0MC4xMTAoATD88I2hBQ..&tag=2239505

http://nym1.ib.adnxs.com/click?SU3SOAo5sz90Us5-EQ2wP9v5fmq8dLM_dFLOfhENsD9JTdI4CjmzPwDmHWJy6vsWP06DGLbOVA4s5BhUAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAADKwAAgUAAQIAAJIAJyN_LwAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=nym1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CL-cjcTh1rOqDhACGIDM95Cmzvr9FiINNzQuMjQwLjIwOS43NSgBMKzI46AF&tag=3024482

http://nym1.ib.adnxs.com/click?BpZUjPQ8wj_7OnDOiNK-PwAAAAAAAPA_4qA8tDN9wD9ojJlagYPDP9uh-ZDg4q9t1TOsCEOjC3mAAxpUAAAAANbwNADtCAAAdgIAAAIAAAB-hyoBfZQHAAAAAQBVU0QAVVNEANgCWgAtCwAA6qcAAgUAAQIAAJYA1iaRagAAAAA./cnd=!UgYvOgiLtL4CEP6OqgkY_ageIAA./referrer=nym1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNXnsMWw6OiFeRACGNvD5oeJ3PjXbSIMNTAuMTMwLjc3LjgyKAEwgIfooAU.&tag=3469526

http://nym1.ib.adnxs.com/click?jYh7M9VWxT9tI-YHsonAP_Cnxks3ieU_bSPmB7KJwD-MiHsz1VbFPwTeS8RvxGt-A1i4SDA82QiCOhpUAAAAAKUCNQBjCgAAdgIAAAIAAABx_SkBw5YHAAAAAQBVU0QAVVNEANgCWgCw6gAAO6kAAgUAAQIAAJQAoSYrbQAAAAA./cnd=!3wZkQgjd85MCEPH6pwkYw60eIAA./referrer=www.reimageplus.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIOw4cWEhs_sCBACGIS8r6L8jfG1fiIPMjA4LjE1Ny4xODkuMTI5KAEwgvXooAU.&tag=3474085

http://files.getsoftfree.com/get/click/.../?uid=20q5VN0xZV6fneED2YQ2PU1wYXZ6000.&sid=99231&filename=Setup

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNfc5t3V-MbyFxACGIKH1tjh1uqXbCINNzIuODguMTg3LjE5OCgBMJrn_aAF&tag=3556681

https://secure-nym.adnxs.com/click?0UTQqT4gxT8iApvDY1_APwAAAAAAAPA_IgKbw2NfwD_RRNCpPiDFP4KDFRu2qi9sV665W8Ub5Reacx9UAAAAAElFNgByBwAAdgIAAAIAAAB-hyoBqIUHAAAAAQBVU0QAVVNEANgCWgCZIAAAOM8AAgUAAQIAAJYAwyG_nQAAAAA./cnd=!Uwa1PgjoxsICEP6OqgkYqIseIAA./referrer=www.youtube.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNfc5t3V-MbyFxACGIKH1tjh1uqXbCINNzIuODguMTg3LjE5OCgBMJrn_aAF&tag=3556681

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMDIi4DIuuiCdBACGLqHlp_5h_HHayIPMTc0LjEwMS4xNzYuMTU1KAEwy5aDoQU.&tag=3024482

http://nym1.ib.adnxs.com/click?PXxCMqJgyD-eonzV7VrEP7gehetRuK4_nqJ81e1axD89fEIyomDIP7qD5ZM_xI9rQOQCgNShBXRLyyBUAAAAAGImLgDIAQAAdgIAAAIAAAB9_SkBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAArscAAgUAAQIAAJIA8CibOAAAAAA./cnd=!DQcUQwjQ9JMCEP36pwkY87IWIAE./referrer=secure.imp-serving.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMDIi4DIuuiCdBACGLqHlp_5h_HHayIPMTc0LjEwMS4xNzYuMTU1KAEwy5aDoQU.&tag=3024482

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CMLH7cXIp7_RZBACGJ7r2_fxgJb7OyINMTc0LjYxLjM1LjEwOSgBMMmI96AF&tag=3505429

http://lax1.ib.adnxs.com/click?1S_f7UsO_T-wpvam2ZzzP7ByaJHtfPU_sKb2ptmc8z_WL9_tSw79P5719h4HWPY7wmO7iDz9omRJxB1UAAAAABV9NQBNBQAAdgIAAAIAAACCqB0BDq4EAAAAAQBVU0QAVVNEACwB-gAt-AAAxsQAAgUAAQIAAJQA-izNCQAAAAA./cnd=!ZQbuPAjtqq4CEILR9ggYjtwSIAA./referrer=http://windows.microsoft.com/fr-fr/windows/glowing-beaches-download-theme/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CMLH7cXIp7_RZBACGJ7r2_fxgJb7OyINMTc0LjYxLjM1LjEwOSgBMMmI96AF&tag=3505429

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.