home

backupsetup.exe

Backup Software Limited

The application backupsetup.exe by Backup Software Limited has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cdn.backupgrid.net and multiple other hosts. While running, it connects to the Internet address 94.31.29.41.IPYX-077437-ZYO.above.net on port 80 using the HTTP protocol.
Publisher:
Backup Software Limited  (signed and verified)

MD5:
bcba8747ab53932f8613c006444078e9

SHA-1:
4495024b25f21088902fbd82fc915e621187fe85

SHA-256:
25ee14ad2de1edd08ba4e9c2b1c5766df81f07579f467c9ed6888416767e6d68

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 2:56:47 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
MyBackup
2015.0.3280

Reason Heuristics
PUP.Optional.Installer.L
14.11.24.19

VIPRE Antivirus
Trojan.Win32.Generic
35098

File size:
290.7 KB (297,672 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\backupsetup.exe

Digital Signature
Signed by:
Backup Software Limited

Authority:
DigiCert Inc

Valid from:
6/17/2014 2:00:00 AM

Valid to:
6/21/2016 2:00:00 PM

Subject:
CN=Backup Software Limited, O=Backup Software Limited, L=Fareham, S=Hampshire, C=GB

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0CAF19B1326854F0FDA6CB110DF30B5C

File PE Metadata
Compilation timestamp:
12/5/2009 11:53:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:8Tq+kUaD6rMfrDzBzpcyg+6sZWIftVu81a/UzQXgDdYrCd+rT:EeUaD6rM7Bzpcyg+6sBVu814UzQwDueM

Entry address:
0x36A0

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file backupsetup.exe has been seen being distributed by the following 2 URLs.

https://cdn.backupgrid.net/MyPCBackup_Setup.exe

http://cdn.backupgrid.net/MyPCBackup_Setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 94.31.29.41.IPYX-077437-ZYO.above.net  (94.31.29.41:80)

TCP (HTTP):
Connects to 94.31.29.237.IPYX-077437-ZYO.above.net  (94.31.29.237:80)

Remove backupsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.