home

www.towerbundleupdate.com

Communigal Communication Ltd

Domain Information

The domain www.towerbundleupdate.com registered by Communigal Communication Ltd was initially registered in November of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Friday, November 13, 2015

Expires date:
Sunday, November 13, 2016

Updated date:
Friday, November 13, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
towerbundleupdate.com

Whois:
1 towerbundleupdate.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M), PUP.installCore (M), PUP.installCore.dobrepro.Installer (M)
100.00%

Bkav FE
W32.HfsAdware
10.00%

Malwarebytes
PUP.Optional.InstallCore
10.00%

K7 AntiVirus
Unwanted-Program
10.00%

ESET NOD32
Win32/InstallCore.ADS potentially unwanted (variant)
10.00%

Dr.Web
Trojan.InstallCore.60
10.00%

Sophos
Install Core Click run software (PUA)
10.00%

Avira AntiVirus
PUA/InstallCore.Gen
10.00%

AVG
InstallCore
10.00%

Qihoo 360 Security
HEUR/QVM06.1.Malware.Gen
10.00%

The domain www.towerbundleupdate.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 15, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 15, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 21, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 17, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 17, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 12, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 12, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 12, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 12, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 12, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 12, 2016

File downloads found at URLs served by www.towerbundleupdate.com.

10 / 68    (Adware)
http://www.towerbundleupdate.com/c?x=Zfsxom8Uj6S1owhBb lMxVTaBrIOOQuT4jtnecJlC8g=&c=UFpFBSSNzPGQG0LVT8083d/aVIMURJzgPMt/XwEeZq97fdVtFyDCldwKIp65JIXpjGUZoSmn6xRSDi2meR8tvAvzhJ2lqqu9GSFQB8xzFIf5ya1z1VqPH fUkcwMzIPOg2I/oc71TcttWWLZEr0RVw==&fallback_url=http://.../ccsetup512.exe&downloadAs=CCleaner-13061-dp.exe  (6e92ec23231a545c7d3944e53cf0d04c)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=hijdcl GgD2WktawTnJUFcwrdQiQTSNbuf9x/9RX Bk=&c=1Mqd3b7Zp7Wz9BR6xHUx5ZzXDG1zFm278Mtazdezod5QymecRg0AEB/JdxLUXrWF8PpJfaLozakivyy4PSh ke29YrwWtVpWldMGAHi38IErn4DXqZB5cJ2QJnI3K6m7wugKe86 8REBvKXdagN5xQ==&fallback_url=http://download.videolan.org/pub/videolan/vlc/2.2.1/.../vlc-2.2.1-win64.exe&downloadAs=VLC-media-player-13060-dp.exe  (871a33524d0e68e956b43c5d0d449b3b)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=mT2gW7Yr wzmnKi5vE6em8 9wn0H3I54LqdFKbNNdSo=&c=ijhqzIvSF0KFgd3aLPP7IwElg/icmnbGlAJ9vByMDhAEvLu78hRi/vuLaafb9J8kLpWhdD7SYoJ3nt6/KMZRGcyqveXsjeAXI2wBoCawV1i5 9j6WozxQM4S80I/f4Q0j1fI0Xf2eeScMLZM0fetsA==&fallback_url=http://storage.dobreprogramy.pl/.../Alcohol120_trial_2.0.3.8314.exe&downloadAs=Alcohol-120-12712-dp.exe  (0f8a9d8ff2a24c4eb99dcc8243aaee4d)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=9ag4HVfOSrQ6FGcEacRCu1FnJ/DR1P1iANIhSpQW9rA=&c=c6gdt8aHKhmv95LaOlazm/N/KzrMVQ7GX N27/LcEVwTM krvt3chBTer0s dddjoUrf7EIPSeuACipQ4s6O225kAVkmCDKw HohVUDITAawb2 6SAEq73ShTUO9x/WUeJl86yYNz9OAJS6PiiL7Hw==&fallback_url=http://www.driverupdate.net/.../SlimDrivers-setup.exe&downloadAs=SlimDrivers-25819-dp.exe  (06e0d2a99e55403cbbbabdad8ad5e17e)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=JikQ30VEZJBhx5C0I qqfGiykCnFAiiNwqB1elQTBnE=&c=BftNT6NvHtnoyA7Qw tP0ioGvlqpbZX59oVBv2lwcg/dXpCQeqz5Cgq5/2M5jmsAlHknonpdZKvqjqW4LMHYM moqxaHb4AIKQT5WyMhhbD2sfq3Wx9/e5HgaURLz5A9FdzgyP2TpuaB4tN6rEagVw==&fallback_url=http://storage.dobreprogramy.pl/.../FacebookMessengerSetup_v1.2.205.0.exe&downloadAs=Facebook-Messenger-for-Windows-29573-dp.exe  (5b6513d21a01a76614fdae3bf191b9e4)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=42ZN8rNLXDKcG1S7Zs8OUsuF7zXXdutSgwhfEfFUCiQ=&c=wj4GDNCaFMKCdK5xTR CGsKArAKQ/GzhqPzkMHkhzBZM6Q6K5736DALnqiJ2IKWP1RggtWOSZ227Qox o4PHGHuS1v57UnzCZBMnQ11Aq6mShKVsROvl28foE73D0L3jaI6hQNAiL3kOVph1wMfqhw==&fallback_url=http://cdn.softactivity.com/.../activmon.exe&downloadAs=Activity-Monitor-48249-dp.exe  (fcbcb4e81a55bdad9c07aa8ba06d7b0d)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=M5J05dLmGfKJmGp RlwDpnnc8te0m1rzQ55CyFZDfhE=&c=X0R2pgLq3lXGg4AwWg/OXTj92e2rO13gmL7ynrcleMwPWn/Im90YL0xhCWMsuGho/b0vqCb9Ba63L5kWDiDUduIOcWUVIkBO7UXO1aNaOh 7CsWJb Iq/lHScrVM6R 5YBgIwbYprzG9rxYW9XFVMw==&fallback_url=http://storage.dobreprogramy.pl/.../windows.8.codec.pack.v2.0.2.setup.exe&downloadAs=Windows-8-Codec-Pack-39542-dp.exe  (80daceded8746c3a3c0a0595823a49a2)

1 / 68      (PUP)
http://www.towerbundleupdate.com/c?x=Ig8zVhsBBPtiP1bD8n4CW14ncoMg3Mnai4sY6TttM8Y=&c=SLx9TpC4RhuWAMIYQIOiX7KDfNprcfimMyrPcYF0W60uabM9Xmlgd5EdongV4e9Hwazpt0BgYkFjqcq5sWxPr1UCt/D9mG5u7 Z5RH736iMW0j6RQFlVgrgMu1R2VTWr3pOKdys8cnryCz4n5jy16A==&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.25/.../Opera_34.0.2036.25_Setup.exe&downloadAs=Opera-12614-dp.exe  (dd9efd98022a2405f6dd67d8930495a7)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=opPt0fe313Y6jxXw9i9HTufodnoaYuw7p7R3rS9OEBE=&c=U8bANAjQDnja9pzvLhWSOyZu4psmjkuUI5GEA8o0w5Q Wn 0POMfylkdoUApI9luGDjrgEjw4hYQVuSG1EdbfUJUhflruYRw3OV3g7UOYhXO/vTSS3/q9ONLn9bpr/ 12g/v3smOwXN5dWlHGEGRA==&fallback_url=http://fpdownload.adobe.com/get/flashplayer/pdc/.../install_flash_player.exe&downloadAs=Adobe-Flash-Player-13091-dp.exe  (cad902e97d860e1fb27371d8af4c2839)

1 / 68      (Adware)
http://www.towerbundleupdate.com/c?x=YEPWYQ6cNQONFZpYZz5l2UPrFs9FKoRc3K2mCD UFRI=&c=lyi3JzQQvxgssA5fhwcdokRMmzEbPVFxyHJHDx8FSLncs0cKqnbCsAvg7UXY70YPKne8lXXohIxEldAGF9wwK79D wwweeYcl Bs2Mib3luAAm3USCwmZr072xP3oFsy7djTzXknItB58d3/mMcNeA==&fallback_url=http://netcologne.dl.sourceforge.net/project/aresgalaxy/aresgalaxy/.../aresregular237_installer.exe&downloadAs=Ares-12480-dp.exe  (d5588398209dd98b246b55a5f9fa8c78)

The following 6 files have been seen to comunicate with www.towerbundleupdate.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.