home

bearshare setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application bearshare setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaulttowerssigns.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
5f350299cb9598ec485fb1b7551a4358

SHA-1:
46a8b2225784a0baee97e9c69391dc3968daffad

SHA-256:
071f3ab573f8b9f101713137cb80e0bf21dbda2ba962194652ef23ddf87ba6c8

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/6/2024 2:33:08 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.31.8

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\bearshare setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:25:15 AM

Valid to:
9/2/2016 3:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:X5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:XdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file bearshare setup.exe has been seen being distributed by the following 12 URLs.

http://www.vaulttowerssigns.com/c?x=dluf9yO ut8bB6 s8 DujM00pGe00mwsErLxYw0o OU=&c=ahv mj6h3cxtdyq5KcNXsC7jgs/4LXJIbap2YzzsCawcGsgZUtrrAMVIhKJX10bQnYMcmWlXZbjWAujGMoNjysyJGFZbT9C292NCKlIObjkAP1mbGbatnFS6/1cW32r9cMhNinFr Pmzsf08nMFTLg==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.centertowernow.com/c?x=nhH8euZ5z4hR7pgH/htWDR0WEQrHdru1f6S9T6/jSzA=&c= a1Y0qbMMzoRrEuwDdqMAaqS/kvnBHU3/GP9dZ7vk39oVYr1AW2Dhl6RSZuD9iXc0nuaBm1rftSAjMW0xb74KDNXKnWtnL9fi381bbjutlRx wpmjH3AHeUD6Xj ZktuBoELeOK3v5vyt1wtsR6M8A==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=jMBtqNyANko7v9QuajHv3TZbBonsFce08LWrVwWLqSw=&c=Lq7KZ B6Ls/5p5/N 80O6lr9g3PAUI01Cp4XEUFqarYNEU3exD6P1/ULoVVEwA65LZ0 pDVTq5VS33L9bB4gIx8/eImlRsUsNq jHnp8niMTiedxcRk4t K2KVg8Vi2f32dXDfcfqvnTml5 NONw==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=A84unu1Mq8LPzfZsa2gQD4DWumxYCZ1g69ct4k3bRWg=&c=ODAYpGE92A1doaub1qWuO8injYU8PNBv8/BH78Efxlvw7rs9 TRm2S0zKf3Nkim8mcaxwivJicnYJMgNt9IAGXtnSRHaGm EvNJD4T4htZmc7hjW3xVVIoaLMQ4TycqYZK3bUDUJHRVy7vMlHyRDcg==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.currentbundlescontent.com/c?x=NFWlwrm7TUXEJd9OnyJvuUPt RgAujO55zKTCWbD2T0=&c=vWlkCpdykFOZCIlJZZHecu5qRfQCwEMSwRnLkFNE5cRvygRHUNxK7SaUGdqsKEbn0drTjxY36p9c2Z6QCfmDEqD4nUJ/cnk SQYAFVkvYRITdEdSF FX9ZBziCeqZXv1MutLshpStrR/sD7cKjQ6eA==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=/ZX7IPMn5BY7l7NPcWFrUsFBAMZLntPlVeqFanqur1s=&c=xOA8OJLtf xZUCjNchYrsSIQEWv95xU5hyhuQRuc4SgZf2Tc37/b26XKuxyLkevJeerztPMSdpx jRMtRFC7CzOBBsO4jaT4sYe6v0TvYDGP2gL3LJZ/Hgw PAb481rYs72LsBB9yr4RF4No78BiCQ==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=2w1yiZ/MxtqziHhOVqQ/PSpTPbMqJe9mQ/GvvRCRCLs=&c=F9J/dyFAYSBCIkGlncDeYzFLDT1ZviQ oXFxOqeVe4ADtKxM8Zup zyJ/F5yAGNR TVdF3xbOPGVa g JgJ4qzBoty ySnUPIc9HXyDUoKmniUcyNkBNgfJmbJ p7tPX0eT7XsqRW1BTw2DNAi6zcg==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=fMpl5i2SFd2qyCj4C2b59OosHbRhCrInmxyva7lnubg=&c=hg 3hXAHs2V8D vSA KPgwG3L Tyst2T4VlVqXPjtoG6NTI7dgg3ECWSGRObG/wqUqZMGToLHLwFLeC tY47iIslDR0hGNN62VxZkroBs4Yb4qppZuH0jOEgkvWNyheyb4/biePqtmT5GT2lidugw==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=nLSjUhW3NQ0Y1k8WTIK21r vfBNIb9WUdWiFgqqCybI=&c=Pl0PnBP5Ri6y8MhJPnef86jzlxSuL5iTJd7yNv2g0cYlnoM1/vwvBWr3qhlCpy/hLIG7tCFwbrhFzGFT3B2S2wldocjHDO3Ds1iorDZLkDpFwyMWkLttWK leGf8MDrPD3gc5W6PAGDLp7BwtpnRZA==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=0QcjXeJYTVBk8STKkhiu9C0lNyesmAxri91k0NUymxQ=&c=gAj8CMU5rW31ZJ6aKNkd4QJ8hVkB4Z1q9SGmAX2R77HAkBCJdrCjcUch g7NHjv4Ao9btZiCn3ZUbDAk5enu RB6M24orGHZQlg5M4AjAQUmVfCvH1Ylgr0cMe589LQ O4au7W3grap0jlE9UAFPCQ==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=6hDtn49OAe0bQbfkA5SKAIe5uxfsDqptU8R0hW6hq7A=&c=lvHWE0JDMKhxxi5cDyo0NNn0S7W3TOpzrYYkO04MduVL N/qm/WLt96tSPsUXOGpKmnY1xRgPwuXNsJK5uB0nrMTH L3qr2e/woKxhaPVhHmtJmLZ8yIfQvhEQ5rM8Z3ieuWfS5KaBigKdPMB6NBSA==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=BHkYEExme3Bl1qkXUOgHb6nhgcqLWLyW4Pln67WEEao=&c=0bSSb D/eXIw9EO1najqpbHJGRSHM44AfaJToYB5BgXyvKlTv6JsXU80OcRVT92mFM9RTmnT3aFmGhGCqstKF0IVPEKJ3w1Aqwr Nfxyi8oqkqqcpRoxChtvkZIHyU8KXhn9fCgRykux4vC2r0gHtw==&downloadAs=BearShare Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove bearshare setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.