home

icreinstall_counter-strike-go-programas-gratis-net.exe

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_counter-strike-go-programas-gratis-net.exe, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.besttoursvaults.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
c08b96ae37ecc6a1f2513b820872e6b8

SHA-1:
c0acb1926c120ee995a630de358fdc1bb954f1fa

SHA-256:
9822dad85912aba3333b0009a2c2ee0e796509c874bfce74e4b72d02fc2a1c07

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 6:27:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.19.12

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_counter-strike-go-programas-gratis-net.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:2KSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:2reTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_counter-strike-go-programas-gratis-net.exe has been seen being distributed by the following 8 URLs.

http://www.besttoursvaults.com/c?x=zQJmh4 77C1hPI1vZSw7cM1 5HZXK8S8DveDH9En/ao=&c=4CiDtYSshl vWlhIzcDuuSF9dQrwfPmACVD1AJMA 48CCwrj9Hs8jCZlCtXUIacneTVNYb8DyeZimws0E7htiqYogKZzCiRoSDhQp1OHHeFICsGUmTtIVOJqtuxB3wrOXLBayyp596II4/mzc0L4b136NyvhtENQCDszvvCDe9k=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.bundlecentralbulk.com/c?x=KcSPE2PEB4vi20/SQHmSyBdhPmKLaNSuryURXEfGJC4=&c=YQm6DaC5YYzeusU22KKqOP4HlPKlpsfnMwUXvHTCb6MCPpfJRLeXhTvBb2giUzu/D6ntz42mnBRq7yFUi5Y/CxMJAd7u8ULKYwR3g5jaOAWi1WJ3L4VJKOtLhPdSjMkTlyXogfj5f/24slHDpbayEFAmBaFefqUmgeI2LU62LXo=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.sendtowersnew.com/c?x=b7eAVSdm TJZFvQVm9A9438VjZSs27QXdxyRnoJD4B8=&c=j538iW7luY1uqFf1p69r3NOl8Lasmsa/tudzRFZ15DAAMjLB/OfxysaYPKEX/Uc5sQ0i0N3iYwMNwAbwy4bOwvk0H/QHK7VqjNR0u94cZDvhXFbJ3tYMiKPDFBFRK7VAelQ7aDua/SJNLau3bMxeqPfSxHZGZGAcjsT60n6DKrM=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.sendtowersnew.com/c?x=TfsYNjBVLphqkD6ccZ9VZxBz wPrQmo0UYv5Y1F9PVM=&c=9dHDkLu5z6EDVFvBmV4h7Uy4n2HKBI0AtKOFuT/NY6Dk3BO5AGq/7hbOi9MNBV9NCKU4MHiSgLxMh3kE7ay0o3HfTxxtvqe8nknm3xdPFKiSwEhiIszRTBMZuVF1L0Ztz4zcRMVdQFqmC/Y0AgkSijt7x0bxyELk3lznvxID9co=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.sendtowersnew.com/WVl6OTRQVEJEVFVJbE1rWmtNaVV5UmpReVFqRk5abVpZUmtJd1dVTkhaRzV2VmlVeVJsVXlNMmRxWmtKMFYyTnFjRUpJTWtFbE0wUW1ZejFHV1RjMGNITm9KVEpHVHpCeGVHSnRXamhvVFc5WVExWjZUMk5rVW5RM01XZE5UbEExVWtkWGVsSklKVEpDYlhsUVVHTndOMWRRWnpVeE9EZzNiM2g0VTFSVFEydG5OMDVRTkZSd2FuSllaRzVvVUhKeU4xQkxNV0U0WVdsTWJtUndVV3hsVjFwaU1rbDNUbk5oUmxkbFRVRkxaVkIxTXlVeVFqUTVibk5aV1cwbE1rWjZRa014Sm1SdmQyNXNiMkZrUVhNOVkyOTFiblJsY2kxemRISnBhMlV0WjI4dGNISnZaM0poYldGekxXZHlZWFJwY3kxdVpYUXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHWm1sc1pYTXVaRzkzYm14dllXUndjbTluY21GdFlYTXVZMjl0SlRKR1EyOTFiblJsY2xOMGNtbHJaVWRzYjJKaGJFOW1abVZ1YzJsMlpTNTZhWEE9

http://www.sendtowersnew.com/c?x=CGCcfA0mir8L9Z8wnQTwMyXl/lfBXQuw MbKx/KyzqE=&c=LAk17YrERaAGFck5wBdRfdTn5f7crR1ai85S0itXOSVcX VwqcnVeUT0D29RHj8M/0QUwRH8rPHqvtSfeMzFSC gKpZWoS1w214/8ODlt8Kamlm9kwODbLQUPGCXGWBou2QLieMW3Kl 1Rl0 wixlWQNDW8fFMCRQ63wDgGHN8=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.sendtowersnew.com/c?x=swChyHB60R0YG eMRaVCZ3BH4C9GflLuzN55CKggNu8=&c=zj3iBfL7N 3xrSuyl6KqxEzIo10ZK7Zk9N P3Q4M494CwU96cYETAWM0778WSKgwpTAVj6WPQQcY0 8KX2vT18S4iBPiYgA7Sps42PvQE SjhrVXYFdlpVthMl9NqSd9ZF3LzGwQCb9T1aqU62TkTFX4Am5yKXCE Wdow Rd9o=&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

http://www.tourstagranch.com/c?x=muuiA/6q4MECRLoevdcxv49wfVEQmb0FxhuM3BwHiCk=&c=hX09EzkAErpbmJN5OiOBHYSOIowU0XIM0WdAkbry0llbv yrdcNLpHLfALDwQbhEPlXKLUzl inXCVJ4XxzSrhnzs44Idh7FixpgLkur3cU6WqrjoLeIzLzQXtpIrrReW6HXjyWC4k/JCD0FFdOFW/ VddSQkQRNhBmJJH6DfZIMNLjsM2p665knv5Stonhj&downloadAs=counter-strike-go-programas-gratis-net.exe&fallback_url=http://.../CounterStrikeGlobalOffensive.zip

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.