home

beamng_drive.exe

Dobufomon

Morava Group

The application beamng_drive.exe, “Dobufomon Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsfilessafe.com and multiple other hosts.
Publisher:
Rat   (signed by Morava Group)

Product:
Dobufomon

Description:
Dobufomon Setup

MD5:
7a21dd1613dc161a8beddafd8c41dfd8

SHA-1:
787d8d2c383fc6c989f9e8bf314339491ef903d3

SHA-256:
ce0d2bff17a4984f8290ddbf9beab7f152a4b0ed058c61ab1201aeb58d2d2a23

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 2:51:04 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.5.4.21

File size:
938.2 KB (960,736 bytes)

Product version:
2.3

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\beamng_drive.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 3:28:01 AM

Valid to:
3/8/2017 3:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:bGiAwqnQLBwS7hMnUMPGAB6Hmbzo1+p/cx:bX3uOSnLPruZ3x

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9315

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file beamng_drive.exe has been seen being distributed by the following 5 URLs.

http://www.appsfilessafe.com/c?x=/.../uS5V34=&e=0&downloadAs=BeamNG_drive.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=2ZQDo0KeeTeMpNvAQvLPiyUU3XPx3H6i Jh23hudhRo=&c=sKqmxGQuzRk11O32 noPBSWSO NF77GOcHGm5dknzdC9AmeLVl8bK2amSVA7NcQbASPo0i0mouMEh/.../sv979sO58WPqLiYF8&downloadAs=BeamNG_drive.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=GUfoQOhDfDy/uOrn7HTO0Zz4f4KUX7uuENDsNREiJpQ=&c=Lyz9OMN8LwWYVOLaG/LqsZ7cCS5Is rX MXYISI3euiNMM4R 3vwnd2Xn67O3SFftXVd2xlbjdf4yp5f2z 3nSu9XiKR6CPw77EA9fmAP/.../mSXtNMGWr6kS4a6A1YKSOOQghrszGQgyE2hr4&e=0&downloadAs=BeamNG_drive.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/.../sJM=&c=4f6jzt3oGAkqJ5BcTGjHgJbhl1 f3IWKPUoMryfQq4oT1M6JPA0p3J1zlIjpHmFx0pWY4TuwrElvnz8iS CM9cxNR6nQ9DJvPXoRfxcprU42mVN0fipr3cABNxO2vhUQ0aIT42wE9P8706naEMdG4tzkXNvlWgTCKH4QGTXJT26SgtmNW3tRD6snpHYc db1&e=0&downloadAs=BeamNG_drive.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=Y4k0hTEtrhZRScOQCirV6x3oxBddooX7CKwzU7pDtvs=&c=bIDAlCZS1Yd7QXA5HBRGZ2IpbJnZtEoa/pyqCJbIs48O1tCshpcJ/n/r0yA5qML1h8Yrt1NsvhlKi3a0SfL5/.../UhYB6YWWqKuI15 QS4&downloadAs=BeamNG_drive.exe&fallback_url=Fallback URL

Remove beamng_drive.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.