» trusted saver-updater.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (1)

trusted saver-updater.exe

Brightcircle Investments Limited

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application trusted saver-updater.exe, “Trusted Saver exe” by Brightcircle Investments Limited has been detected as adware by 4 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Trusted Saver which is a potentially unwanted software program. It is built using the Crossrider browser extension toolkit; the Updater component is used to dynamically connects to the Crossrider API (update.srvstatsdata.com/.../{CAMP_ID}/update.json) and download additional code in order to automatically update Trusted Saver extension/toolbar. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

Publisher:

Trusted Saver (signed by Brightcircle Investments Limited)

Product:

Trusted Saver

Description:

Trusted Saver exe

Version:

1000.1000.1000.1000

MD5:

859723f089d61ae4cd6522b644d9058f

SHA-1:

2cdf5e85b1139fd014f95f00f6fb4c39bf124b91

SHA-256:

bcda6f5566ccb102794ef6f6d41711402d4bf5a731f347fbd5f82c990ffe8aa4

Scanner detections:

4 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform. This is the updater mechanism that runs in the background as a scheduled task. Distributed through the Brightcircle investments brand.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Brightcircle Investments Limited.

Analysis date:

4/20/2024 1:30:09 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic_r

2015.0.3488

ESET NOD32

Win32/Toolbar.CrossRider (variant)

8.8944

Reason Heuristics

PUP.Crossrider.Task.V

14.8.7.21

VIPRE Antivirus

Crossrider

22590

File size:

355.9 KB (364,392 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Trusted Saver.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\trusted saver\trusted saver-updater.exe

Digital Signature

Signed by:

Brightcircle Investments Limited

Authority:

GoDaddy.com, Inc.

Valid from:

3/8/2013 7:33:54 AM

Valid to:

3/8/2016 7:33:54 AM

Subject:

CN=Brightcircle Investments Limited, O=Brightcircle Investments Limited, L=Nicosia, S=Strovolos, C=CY

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

047F36483DC84C

File PE Metadata

Compilation timestamp:

5/21/2013 7:54:43 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:Mj4BhLhGBE+DK59xaYwI9ZNTEsVf1mTy4+fNkm6ecmpTBwnfv:QoLhGBEyK59xaJI9ZNIYIG4+faUpTM

Entry address:

0x2D764

Entry point:

E8, 2F, AA, 00, 00, E9, 89, FE, FF, FF, CC, CC, 57, 56, 53, 33, FF, 8B, 44, 24, 14, 0B, C0, 7D, 14, 47, 8B, 54, 24, 10, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 14, 89, 54, 24, 10, 8B, 44, 24, 1C, 0B, C0, 7D, 14, 47, 8B, 54, 24, 18, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 1C, 89, 54, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 18, 8B, 44, 24, 14, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 10, F7, F1, 8B, D3, EB, 41, 8B, D8, 8B, 4C, 24, 18, 8B, 54, 24, 14, 8B, 44, 24, 10, D1, EB, D1, D9, D1, EA, D1, D8, 0B, DB, 75, F4, F7... 
[+]

Entropy:

6.5234

Code size:

273 KB (279,552 bytes)

Scheduled Task

Task name:

Trusted Saver-updater

Trigger:

Logon (Runs on logon)

Action:

trusted saver-updater.exe \runupdater \agentregpath='trusted saver' \appid=3

The file trusted saver-updater.exe has been discovered within the following program.

Trusted Saver

Trusted Saver is a web browser extension and Browser helper Object (for Internet Explorer) that delivers contextual based advertising to the web browser. In addition it will modify the user's browser home and search pages as well as 'New Tab' pages to push advertising and search.

64% remove it

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to lb-212-222.above.com (103.224.212.222:80)

Remove trusted saver-updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.