home

mp3rocket-win.exe

MP3 Support

The application mp3rocket-win.exe by MP3 Support has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from global-shared-files-l3.softonic.com and multiple other hosts. While running, it connects to the Internet address hosted-by.leaseweb.com on port 80 using the HTTP protocol.
Publisher:
MP3 Support  (signed and verified)

MD5:
210192501e358866a864a2202347ba25

SHA-1:
7c3b88f7ab8ad2d11bb5606b5540d7374e5b0657

SHA-256:
ede7707ca375bac2a925ab85af9ad26981d34b2db8cb71ad3a83d3360dae209b

Scanner detections:
8 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 8:51:06 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Kryptik
7.1.1

Comodo Security
UnclassifiedMalware
18000

Dr.Web
Trojan.MulDrop5.10078
9.0.1.0103

ESET NOD32
Win32/Kryptik.BVVE (variant)
8.9672

Fortinet FortiGate
W32/Kryptik.BVVE!tr
3/27/2014

Qihoo 360 Security
Win32/Trojan.4bc
1.0.0.1015

Reason Heuristics
PUP.MP3Support.N
14.3.27.9

Trend Micro House Call
TROJ_GEN.F47V0324
7.2.86

File size:
649.8 KB (665,424 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\mp3rocket-win.exe

Digital Signature
Signed by:
MP3 Support

Authority:
Thawte, Inc.

Valid from:
6/26/2013 7:00:00 PM

Valid to:
7/11/2015 6:59:59 PM

Subject:
CN=MP3 Support, OU=SECURE APPLICATION DEVELOPMENT, O=MP3 Support, L=Oshawa, S=Ontario, C=CA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
146C2E323177663B9DF87FFF1B9C31D8

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:txnvp+jZLHFzQZInki9abZP1Rr7cbcOg8idBBKjfCUrfrMDTDD7W46oJ/dSWe:txnvcjXnR9abZtF7c+8iwf90764j/+

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mp3rocket-win.exe has been seen being distributed by the following 50 URLs.

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140626094921&nva=20140626215021&token=06f634fe2da804309f212&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140416140202&nva=20140417020302&token=0ddba9ceaf6ade2c29f08&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140618020246&nva=20140618140346&token=034f643fd541d21cfefa8&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140512032340&nva=20140512152440&token=0abc72e53cd4bc36c9939&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140611225528&nva=20140612105628&token=0b9aea54c068a098e4e6c&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://mp3-rocket-download.software.informer.com/.../

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140416122340&nva=20140417002440&token=0b0fe274992dfd7463f95&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140405210959&nva=20140406091059&token=03ae78d586dbdc2ee18d0&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140604185257&nva=20140605065357&token=0ecb30311d057e0e6ca2f&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140531112757&nva=20140531232857&token=060ad70f3baa41c23170a&id_file=54821&channel=WEB&instance=softonic_br&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140428215749&nva=20140429095849&token=024727dcff1547fd57f3a&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://nl.inncdn.com/download.php?os=&icon=aHR0cDovL2ltYWdlcy5ici5zZnRjZG4ubmV0L2JyL3Njcm4vNTQwMDAvNTQ4MjEvbXAzLXJvY2tldC0wMS0xMDB4MTAwLnBuZw==&desc=QmFpeGUgbyBxdWUgcXVpc2VyIGRhIHJlZGUgZGUgaW50ZXJjw6JtYmlvIExpbWVXaXJl&name=MP3 Rocket&domain=mp3-rocket&ss=&lang=pt_BR&url=aHR0cDovL21wMy1yb2NrZXQuc29mdG9uaWMuY29tLmJy&version=051114&ins=apportalbr&gclid=CPW33MmA9sECFetj7AodvxEAwA

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140330171304&nva=20140331051404&token=06c74949893cd73dc3d67&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140413200917&nva=20140414081017&token=0b57cc6d71e6c3323e2db&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140509235654&nva=20140510115754&token=0363094f993ee0936528d&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140602183148&nva=20140603063248&token=0b1b755fa55879a197855&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140609090119&nva=20140609210219&token=0ea0a0103210bfeb94db1&id_file=54821&channel=WEB&instance=softonic_br&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140430202018&nva=20140501082118&token=0e2d49d71cdce14f2a9c6&id_file=54821&channel=WEB&instance=softonic_br&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140425004522&nva=20140425124622&token=06f9a5468fa64572a7516&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140329075653&nva=20140329195753&token=058e17acc93a9d3b542ab&id_file=54821&channel=WEB&instance=softonic_pl&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140716164322&nva=20140717044422&token=02a36a46bd5e9b198e714&id_file=54821&channel=WEB&instance=softonic_nl&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140520160646&nva=20140521040746&token=02e949350cdb630ef2691&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140413210100&nva=20140414090200&token=0c29199c76a200b473121&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://gsf-cf.softonic.com//7c3/b88/.../file?id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&Expires=1404267431&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=cu84qUEXkb3CziFGGAfOvQ0btqrMTCMUrUGgPpQAmYo0SIMxs-F6LzPsNA3B7jEENQ3iLV7ynbZG9grBuzGiDUbJ8kCKLYEaqI08VBAcK1~bOFoDSD-pYG4-bP-Is0Qw-i3hGavC69xyhB9xT4qcLTGwgRR39zqTgO909WUOO~E_&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140706151854&nva=20140707031954&token=0084f86193aa5789a6dcf&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140331141305&nva=20140401021405&token=0030d66c48f9a237c5ba1&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140707143606&nva=20140708023706&token=0bfea6fdcfd54f968ef89&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140509195905&nva=20140510080005&token=00e30a6a38b134b0fe11e&id_file=54821&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

http://mp3-rocket.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAN70rLmtU4QvRHhh11sg2//C51RKcLmjXrJTT/v79rMJceORDO/9Yi FoIk2sPfh9VE2zVsf45PvaBJvVlvd9hfxIVP2NascALJHJCuHpjNTPMTUDBnnENmCRG9Lh3VPGvF8xKUYvcqVW daHixSmZwTMtduzJSfR4NFIfCj5hGCGTKJisi8kPv8OMqXmXGuVNlXBBETNTjjvo7yO414BIaJFhO rTZAf5gRcoHDzfmOXyC6mxoYU YoVTXYtjJFn3sd0B1L26hdx8WeSnz4KFFtNHiqKfb7wlgGOLaX8jM twj2DwNtVIA7w28VI/F6zN0ag0dN1MT4kXKSkrA9JaFpvSTTYGMgDLVSp00uMCg/.../GsrXeKb2GXTD S8lTAZOvj2MbgRgUwSTfzeR KbQqy6jMWCEk4jx1UdvIJig==

http://global-shared-files-l3.softonic.com/7c3/b88/.../file?nvb=20140621185901&nva=20140622070001&token=0a084eda3f7bd2df1ef80&id_file=54821&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=no&SD_used=0&filename=mp3rocket_6_4_7_0.exe

Latest 30 of 59 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.155:80)

TCP (HTTP):
Connects to ec2-52-208-40-227.eu-west-1.compute.amazonaws.com  (52.208.40.227:80)

TCP (HTTP):
Connects to 50.115.122.45.static.westdc.net  (50.115.122.45:80)

Remove mp3rocket-win.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.