home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 7 anti-malware scanners. The file has been seen being downloaded from nym1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
681a294031c429d5aff5a66aff121c1c

SHA-1:
c490e65681f9548c42ac862105b3145c2e0e57b7

SHA-256:
aaee97d9e15a1d487687b02929c106aba2f0acc09aaece52c7632a00237cf8c3

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/26/2024 4:38:07 AM UTC  (today)

Scan engine
Detection
Engine version

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3363

Malwarebytes
PUP.Optional.Conduit
v2014.08.23.09

McAfee
Artemis!681A294031C4
5600.7030

Panda Antivirus
Trj/Chgt.C
14.08.23.09

Reason Heuristics
PUP.Installer.Stepitapp.I
14.8.23.9

Trend Micro House Call
Suspicious_GEN.F47V0802
7.2.235

VIPRE Antivirus
Conduit
32070

File size:
400.4 KB (410,032 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 4:00:00 PM

Valid to:
12/11/2014 3:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
8/1/2014 11:48:30 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:U47AtFCVibqI59PpOPf201/z7pHmJI9ftR4lG2Z7A:NAtMVibqI59Pk2cb7pHmJ0ftR4ltFA

Entry address:
0x6227E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1842

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
385 KB (394,240 bytes)

The file setup.exe has been seen being distributed by the following 25 URLs.

http://nym1.ib.adnxs.com/click?yOA6CeH69T8CeIpCTz7yP4XrUbgehfc_AniKQk8-8j_I4DoJ4fr1P8tVb9ctyL5ZsFMDKEr_iH-nOvlTAAAAAB_OMgCTBwAAdgIAAAIAAADrIRwBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAAKrEAAgUAAQIAAJQAdyjKKwAAAAA./cnd=!uwYZQAij-6kCEOvD8AgYhdkdIAA./referrer=http://session.masteringaandp.com/myct/assignments/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLCnjcCi6b_EfxACGMurvbvdhbLfWSILNzIuNzQuNDIuNjkoATCn9eSfBQ..&tag=3329567

http://ams1.ib.adnxs.com/click?n6G3P82tK0Cfobc_za0rQAAAAAAAACxAn6G3P82tK0Cfobc_za0rQECRoY7cm9Ruff3_7jCUnFSH5AVUAAAAABEsIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAA2bcAAgQAAQIAAIwAViY9IQAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.download366.com/windows-live-mail/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CP36__eOhqXOVBACGMCihvXI-6bqbiINOTAuMTMuMTEwLjE4MCgBMIfJl6AF&tag=2239505

http://lax1.ib.adnxs.com/click?pUjKMD2auz8axZzSVWS1Py_dJAaBlec_GsWc0lVktT-lSMowPZq7Pyr5b3XVMcw4phO04HufUAsnzPhTAAAAANaQMgDaBgAAdgIAAAIAAAACIhwB6jIGAAAAAQBVU0QAVVNEACwB-gDzsQAAUMEAAgUAAQIAAI4Aiie0ogAAAAA./cnd=!XQbROAiwiqsCEILE8AgY6uUYIAA./referrer=secure.imp-serving.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CKan0IW-76eoCxACGKryv6vXuozmOCIOMTA3LjIxOC4xMjIuMTIoATCnmOOfBQ..&tag=3313878

http://nym1.ib.adnxs.com/click?BZZNOvI08z9QWkN1IeLvPylcj8L1KPY_UFpDdSHi7z8Flk068jTzP1M0ttRR6N52UeJzaGPgomBu3vdTAAAAAB_OMgCTBwAAdgIAAAIAAADrIRwBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAAA7IAAgUAAQIAAJQArydwrQAAAAA./cnd=!uwYZQAij-6kCEOvD8AgYhdkdIAA./referrer=http://www.smallworlds.com/space/thechangingroom//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNHEz8O2jLjRYBACGNPo2KWdirrvdiIOOTguMjE4LjIyMy4xNzEoATDuvN-fBQ..&tag=3329567

http://ams1.ib.adnxs.com/click?LYnTxM71HkAtidPEzvUeQAIrhxbZzgVALYnTxM71HkAtidPEzvUeQA8_UE2bF25mwYypZbill3FepfRTAAAAAFQsIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAAMbgAAgQAAQIAAIwAayfG6QAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.win-install.com/microsoft-excel/thanks2/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CMGZpq2Gt-nLcRACGI_-wOq084W3ZiIMOTIuOTAuMjYuMTA4KAEw3srSnwU.&tag=2239572

http://nym1.ib.adnxs.com/click?Wo8LMIk4-T_x3-q-7O70Pylcj8L1KPY_8d_qvuzu9D9ajwswiTj5P1SyA0wNy-I1SzZGTUmTjxY4dfdTAAAAAB_OMgCTBwAAdgIAAAIAAADrIRwBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAABdAAAgUAAQIAAJQAQinsxgAAAAA./cnd=!uwYZQAij-6kCEOvD8AgYhdkdIAA./referrer=http://www.roblox.com/games/?SortFilter=0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMvsmOqU6eTHFhACGNTkjuDU4bLxNSILNjkuNC4xMDcuNDIoATC46t2fBQ..&tag=3329567

http://nym1.ib.adnxs.com/click?N1jvBAgt-T9MN4lBYOX0P0w3iUFg5fQ_dGeqoHZk-D-rxnAqc2P9P3-imVC0qWNpC_bQ0LnmS2wCNvZTAAAAAB_OMgCTBwAAdgIAAAIAAADrIRwBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAAFc8AAgUAAQIAAJQAjCd-nQAAAAA./cnd=!uwYZQAij-6kCEOvD8AgYhdkdIAA./referrer=http://www.videolan.org/vlc/index.html/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIvsw4ad1_mlbBACGP_E5oTFtuqxaSINOTkuMTc1LjIwMi43MCgBMILs2J8F&tag=3329567

http://nym1.ib.adnxs.com/click?FaqsVlXjtz_miF-oTfKzP8uhRbbz_bQ_5ohfqE3ysz8VqqxWVeO3Py3ZWZn8_ug8PAhmCRuM5185dwhUAAAAAGImLgDIAQAAdgIAAAIAAADrIRwBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAMKsAAgUAAQIAAJIA4yimqAAAAAA./cnd=!5gZdQAij27QCEOvD8AgY87IWIAA./referrer=search.us.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLyQmMuwg-PzXxACGK2y58rJ37_0PCIMOTguOTUuNDEuMjAxKAEwue6hoAU.&tag=3024482

http://files.getsoftfree.com/get/click/.../?uid=2124--1740--1403479219.8236&sid=FX_1740&filename=Setup

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COOrl9WSxaDuJhACGMmu6siks42mRCINNzQuMjQzLjU5LjEzNSgBMP6HnqAF&tag=3329556

http://nym1.ib.adnxs.com/click?GvUB90rA5T88WGDcrg3iPzMzMzMzMwdAPFhg3K4N4j8a9QH3SsDlP0mXGkmaNUxE49WlKimC3Cb-gwdUAAAAABTOMgCTBwAAdgIAAAIAAADrIRwBCmEHAAAAAQBVU0QAVVNEACwB-gDnOgAAiOIAAgUAAQIAAJQA2iOmVwAAAAA./cnd=!pQakPwi027QCEOvD8AgYisIdIAA./referrer=http://acvzz.resolve.governorfaucet.biz/?sov=62706301/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COOrl9WSxaDuJhACGMmu6siks42mRCINNzQuMjQzLjU5LjEzNSgBMP6HnqAF&tag=3329556

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CLCs0KqVos35RBACGJLzmJHUu6fUCSIOMTczLjIxOS4xNC4xNTEoATCa_dWfBQ..&tag=2779257

http://lax1.ib.adnxs.com/click?4lUkHggbuz_C9SjkvwG1P0w3iUFg5bA_7zMhPsjNyT-BIeyCy6XQP5I5JkLdnagJMBZUVRE180SafvVTAAAAAHloKgByBwAAdgIAAAIAAABN7vUAg48GAAAAAQBVU0QAVVNEANgCWgC2MQAASb4AAgUAAQIAAJIAQybxIwAAAAA./cnd=!KgZTOwizwaACEM3c1wcYg58aIAA./referrer=http://cdn.sharedaddomain.com/ancbanner_general4_728x90_195.htm?cat=21,107&clientId=4b713dd3-3370-4c96-a794-babeb80abee5&l=http://www.a10.com/action-games/newest/&r=http://www.a10.com/&kw=online, games, free, arcade, action, puzzle, a10, a10.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CLCs0KqVos35RBACGJLzmJHUu6fUCSIOMTczLjIxOS4xNC4xNTEoATCa_dWfBQ..&tag=2779257

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPrErLC4kKqbGhACGMio1JKn8er1LyIMNzIuMTc3LjkuMjM0KAEwooHwnwU.&tag=3329567

http://lax1.ib.adnxs.com/click?AAAAAAAA8D-QwvUoXI_qP90kBoGVQ_s_kML1KFyP6j8AAAAAAADwP0gUVXKKq-sveiILhoOoNhqiAPxTAAAAAB_OMgCTBwAAdgIAAAIAAADrIRwBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAA8NsAAgUAAQIAAJQABSJtVQAAAAA./cnd=!uwYZQAij-6kCEOvD8AgYhdkdIAA./referrer=http://mail.twc.com/do/mail/message/view?suspendPrivacySetting=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CPrErLC4kKqbGhACGMio1JKn8er1LyIMNzIuMTc3LjkuMjM0KAEwooHwnwU.&tag=3329567

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNXGlKaTmpf2YxACGLDwlcnn-PDERyINNjcuMjM1LjE2MC43NCgBMI31yp8F&tag=3323611

http://nym1.ib.adnxs.com/click?74TP_wlg0T_cWYtM2nTHP_yp8dJNYuA_3FmLTNp0xz_vhM__CWDRPzB4JXnGw4lHVSPFNNFc7GONuvJTAAAAANu2MgAdAgAAdgIAAAIAAABN7vUANr0CAAAAAQBVU0QAVVNEANgCWgC0PwAAkLUAAgUAAQIAAJQA5yzHuwAAAAA./cnd=!CAcLQwj50qkCEM3c1wcYtvoKIAA./referrer=http://cmtgproperties.com/search-homes?utm_source=msn/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNXGlKaTmpf2YxACGLDwlcnn-PDERyINNjcuMjM1LjE2MC43NCgBMI31yp8F&tag=3323611

http://lax1.ib.adnxs.com/click?4lUkHggbuz_C9SjkvwG1P0w3iUFg5bA_7zMhPsjNyT-BIeyCy6XQP5I5JkLdnagJMBZUVRE180SafvVTAAAAAHloKgByBwAAdgIAAAIAAABN7vUAg48GAAAAAQBVU0QAVVNEANgCWgC2MQAASb4AAgUAAQIAAJIAQybxIwAAAAA./cnd=!KgZTOwizwaACEM3c1wcYg58aIAA./referrer=http://cdn.sharedaddomain.com/ancbanner_general4_728x90_195.htm?cat=21,107&clientId=4b713dd3-3370-4c96-a794-babeb80abee5&l=http://www.a10.com/action-games/newest/&r=http://www.a10.com/&kw=online, games, free, arcade, action, puzzle, a10, a10.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CLCs0KqVos35RBACGJLzmJHUu6fUCSIOMTczLjIxOS4xNC4xNTEoATCa_dWfBQ..&tag=2779257

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLmE-syazOXMZhACGKKOvKi28cjDdSIMNTAuMTA2LjQ4LjUzKAEwkurunwU.&tag=2637608

http://nym1.ib.adnxs.com/click?RCY83oLHtD9EJjzegse0P-kmMQisHLo_RCY83oLHtD9EJjzegse0PyIHD2WLI4d1OYKeqWGWmWYStftTAAAAACg_KAB2AgAAdgIAAAIAAABN7vUADSYFAAAAAQBVU0QAVVNEANgCWgAW6wAA7eIAAgQAAQIAAI4AuyQdhgAAAAA./cnd=!wwYxQQia5PsBEM3c1wcYjcwUIAQ./referrer=http://nym1.ib.adnxs.com/if?enc=KVyPwvUorD8pXI_C9SisP3sUrkfherQ_KVyPwvUorD8pXI_C9SisP_oq0sTMYuJHOYKeqWGWmWYPtftTAAAAAJXMLwBNBQAATQUAAAIAAAB347sAfcYFAAAAAQBVU0QAVVNEANgCWgBjUAAAxrUAAgQAAQIAAJIAzykVTAAAAAA.&cnd=!CyTwRQj6_bYBEPfG7wUYACD9jBcwADgAQARIzQpQlZm_AVgAYOEDaABwHHgKgAEciAEKkAEBmAEBoAEBqAEDsAEAuQEpXI_C9SisP8EBKVyPwvUorD_JAVlYHJ69GeM_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!VAd3Rwj6_bYBEPfG7wUY_YwXIAQ.&udj=uf('a', 250038, 1409004815);uf('c', 2998010, 1409004815);uf('r', 12313463, 1409004815);&vpid=366&apid=250758&referrer=home.mcafee.com&media_subtypes=1&ct=0&rsrc=3&dlo=1/.../%2

http://files5.mirror6.net/dl?bc=1082834&p_tid=dG3MOQHLJMTNPMODGTJO83C2&aid=4cf7024f-f256-4c00-b50a-4515a6dddf77&source=7bb6f12c-c522-4cb0-82c7-fc364d845372&c=4a1d8369-ade7-4dec-957a-6b468deb3d6e&filename=Setup.exe&variation=secure

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CJbf8tq_vq_jHBACGKfs-qLvlovOQyINMi4xMDEuMTcxLjE1NygBMJmwo58F&tag=3144686

https://secure-ams.adnxs.com/click?AEZ0Xgd64D8ARnReB3rgPw4tsp3vp-o_AEZ0Xgd64D8ARnReB3rgPye2XvS2LJxDlq9c-_O9xhwZ2OhTAAAAAO77LwB2AgAAdgIAAAIAAABN7vUAJPwGAAAAAQBVU0QAVVNEANgCWgARWgAAgL0AAgQAAQIAAJIAJCaArgAAAAA./cnd=!VAeSRgjh5PsBEM3c1wcYpPgbIAQ./referrer=http://pcsoftupdate.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CJbf8tq_vq_jHBACGKfs-qLvlovOQyINMi4xMDEuMTcxLjE1NygBMJmwo58F&tag=3144686

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMzk2MeD4Pq8MxACGLDJ4aj38ey2fSINOTguMTQwLjQ4LjIzMygBMN77lJ8F&tag=3318184

http://nym1.ib.adnxs.com/click?nzcZ3xcR4T9QUp5CJi_dP7ByaJHtfOs_UFKeQiYv3T-fNxnfFxHhP7BkGHWPs219TDL2OADreTPePeVTAAAAAKihMgBfAAAAdgIAAAIAAABX7vUACmYGAAAAAQBVU0QAVVNEACwB-gCLLwAAT6sAAgUAAQIAAJQAeiTgiAAAAAA./cnd=!2QZhQgim5vsBENfc1wcYiswZIAA./referrer=http://ib.adnxs.com/tt?id=3318184&size=300x250/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMzk2MeD4Pq8MxACGLDJ4aj38ey2fSINOTguMTQwLjQ4LjIzMygBMN77lJ8F&tag=3318184

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.