» www.set-install.com
Overview
Analysis
IPs Addresses (6)
Downloads (13)
Network (3)

www.set-install.com

Privacy Protection Service INC d/b/a PrivacyProtect.org (Proxy Registrant)

Domain Information

The domain www.set-install.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in November of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.

Registrant:

Privacy Protection Service INC d/b/a PrivacyProtect.org

Registrar:

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:

Virginia, United States (US)

Create date:

Sunday, November 30, 2014

Expires date:

Wednesday, November 30, 2016

Updated date:

Sunday, October 25, 2015

ASN:

AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:

set-install.com

Whois:

2 set-install.com records

Scanner detections:

Detections (85% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Installer.MocaNetworkNewMediaHoldings.M, PUP.NewMedia.Installer.New Media Holdings.Installer (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.S (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M), PUP.NewMedia.NMH (M)

100.00%

ESET NOD32

Win32/InstallCore.SK potentially unwanted application

36.36%

VIPRE Antivirus

Threat.4788237

36.36%

K7 AntiVirus

Trojan

36.36%

Comodo Security

Application.Win32.InstallCore.HG

36.36%

Avira AntiVirus

Adware/InstallCo.zkh

36.36%

G Data

Win32.Application.InstallCore.CZ

36.36%

AVG

Generic

36.36%

F-Secure

Riskware.Gen:Application.Heur.bv1@k0rWeIbO

36.36%

IKARUS anti.virus

AdWare.InstallCo

36.36%

Malwarebytes

PUP.Optional.InstallCore

36.36%

Sophos

PUA 'Install Core Click run software'

36.36%

avast!

Malware-gen

36.36%

Dr.Web

Trojan.InstallCore.45

27.27%

NANO AntiVirus

Riskware.Win32.InstallCore.dmkfpr

27.27%

The domain www.set-install.com has been seen to resolve to the following 6 IP addresses.

54.84.143.69

ec2-54-84-143-69.compute-1.amazonaws.com

December 2, 2015

52.7.132.182

ec2-52-7-132-182.compute-1.amazonaws.com

December 2, 2015

107.23.203.23

ec2-107-23-203-23.compute-1.amazonaws.com

December 2, 2015

54.236.147.238

ec2-54-236-147-238.compute-1.amazonaws.com

May 5, 2015

54.84.140.114

ec2-54-84-140-114.compute-1.amazonaws.com

May 5, 2015

54.209.232.94

ec2-54-209-232-94.compute-1.amazonaws.com

May 5, 2015

File downloads found at URLs served by www.set-install.com.

1 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhL2kvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzczAZAFOZayvm5EIKiWXzAFAZAzNTc3NT7R1&campaignId=9jn0ATgdAzM0AZMq (firefoxsetup.exe)

1 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzL0NjgROTayvm5EIKiWXzA3AzMdNzMRNj7R&campaignId=9jn0ATg0Ajg4AZMq (firefoxsetup.exe)

0 / 68

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzLwNT7FOZayvm5EIKiWXzAzNz7yNjL4NT7R1&campaignId=9jn0ATg1Az74AZMq (firefox setup 27.0.exe)

1 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzndOT7FOZayvm5EIKiWXzARNZA1AT74NT7R&campaignId=9jn0ATg0OZ70AZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzc3OZAFOZayvm5EIKiWXzA3NT7dAjM4NT7R1&campaignId=9jn0ATgdAZA0AZMq (firefoxsetup.exe)

1 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzCyOZAFOZayvm5EIKiWXzA1AZndAjM4NT7R&campaignId=9jn0ATg1NZcdAZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://www.set-install.com/?dl=1&dr=cHaWck1w 32lcEsJIKF0UXDpDX2lcQD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL17vmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTayAjA4AZCRvm5EIKiWXz7FNTc0AjgRNZa=&pd=2323UExoDK5wcHNw r5jDSFj d0=&campaignId=9jn0AjiROZcwAZMq (powerpoint_viewersetup.exe)

1 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAznyAzMwOTayvm5EIKiWXzA3ATgFOZiFNT7R&campaignId=9jn0ATg1ATndAZMq (firefoxsetup.exe)

19 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLVHvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzn0OZAFOZayvm5EIKiWXzA3ATndAjM4NT7R&campaignId=9jn0ATgdAziwAZMq (firefoxsetup.exe)

19 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzL0Nz7FOZayvm5EIKiWXzAROZ71AZ74NT7R1&campaignId=9jn0ATg0NZ74AZMq (firefoxsetup.exe)

0 / 68

13 / 68 (Adware)

http://www.set-install.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLNsvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzLyAZAFOZayvm5EIKiWXzA3OTazNTc3NT7R&campaignId=9jn0ATg1OTM4AZMq (firefoxsetup.exe)

The following 3 files have been seen to comunicate with www.set-install.com in live environments.

TCP » 54.84.143.69:80

WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80

notifier64.exe (Notifications)

TCP » 54.84.143.69:80

ContentFinder.exe (ContentFinder by ContentFinder Company)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.