home

icreinstall_daemon-tools-lite-12708-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_daemon-tools-lite-12708-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Rukimakin

Description:
Rukimakin Setup

Version:
3.7.4.5

MD5:
7b65f42b64a36903a5246c9d82f58b38

SHA-1:
365de139b2388a2fdf20218d61fc4b2cacbcb726

SHA-256:
8d06d8a23c81e11a1efba2a4b1d3ccde57070998038def1dd9b9bb0301245cab

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 4:23:47 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.6.11.2

File size:
960.6 KB (983,624 bytes)

Product version:
1.2.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_daemon-tools-lite-12708-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:37:06 PM

Valid to:
7/7/2016 5:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:iCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:irrwwXEvHstlgJM7k8DNcggxC8

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_daemon-tools-lite-12708-dp.exe has been seen being distributed by the following 15 URLs.

http://www.presentheartapplication.com/c?x=z3War3IsiiK IoIZjJpXwCUcbz8DkU2oafecCptRUew=&c=Bh2FriOSNprEppYkIlFuzwvTmsL3qZnGpRXLMbnxCobdGm0h1SiDssU/20 KBnIEBDocYwRv5v1cf2BgFYKFIGRT4OOOFq60kJcdxi6obTcKlnm94J1ddM4A77M58SdizPKN0xc21wLDTRBba uDTB7xgCrhM3PJaPD39O6do s=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.bundleflashapps.com/c?x=V1ERo8/Br4gwCoQ8IgKol4lOaXwCroWNAEaBR8K0zc4=&c=PhuU 42DeFAAkhyqRmyMUU/60CveddJBBX nvp9m4DwmtAkbyGkjiCx3zNCWkzVKhBRkwaZPdqiWJ //fsZwnyVJSYEubb/9gXnE5RbWZl7BadewQAfHrYjfgDO8R4ykUVP vBECSSfnRM6PLR9rtphGVOXCWMZHrp4Trl6T33M=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.bundleflashapps.com/c?x=C0r9tda1iRnCpcHZZg0dFzXvb84NJZEZnGgmtZqQ4 s=&c=yv6zqlDSXX3 9glcMrdCi9/6UW/62Zy1Zuznxf/nfONap9sHb6lhywxgKmgaFWwpyk50xOABf6oquFwhz8aQhzNItiZFqcmawojLPKExHCgoHY D4DvUAb5/f fuU/LpFiPdpsWdTSWs5KXu7/gkepCjzXqq7/L4/SBzOPPXydc=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.worlddlstock.com/c?x=XU4LGWXMNRUgliQlgcUN8mfNkAXzXWf XKZq5LvEfik=&c=Q1uRqFZjvypFrVUfUKI XJWmHW/qlspsV6PLdB5hjUnBasUpmGdMHtrG0HBMPAQuLoSsO4ytEKPZrCcVaWl5zWnBPR3J9JWIQVj2iShJBP27b hU1WX29TRfTxTNqNyk16HeLfB23oPPvHR sSTArzRKwDpIfRh9lPCiQzaeJC8=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.deliveryheartconecpt.com/c?x=lwLijR3T6htsPceHo3LD2W/d2g5zo5LLZYMe9Z5/Pig=&c=rZBacQQsJojNSlUXitZIs88/WTShrvZeCmE3FGvdBhM2W1fbLcdxcvBVbCSyWxS8EHNmqCJQ5fHWohWsQhKXXQCwoTBlJvmszYYuv2oCJThrWk0S1hOunBhUSj3VCI82fZ7gUN8XVkY6LkpANOt/Na5Xe c 93zk eg686kafac=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.todaymetabundle.com/c?x=kmt8kn7it0DjXTKW7AuW0BxLoXlhEXbrQgqIF21Ehkg=&c=StnwGWKuN9aXHEp1WDzIjwDC/AQYdrPw7 x4HSCWOs/8vjDHDXh9wwOyzc4THRQkO0ng/uezzuTX7St0J262NbV9f8qThAUbT1NFecJfrhkdxDT7 hnEpm2lkmRKTMQJc8XfJYwgHgX88JFW45lo7EvZVxf22RF cdh 14iNTrg=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.deliveryheartconecpt.com/c?x=uNdRxDtdqre2ZoRoqpdQ18fRbyK6lnMQdzhepVbKMwM=&c=ZWD5j696rfAXJkyECUvAUvtLbZ14WFFR2pvSHubV3O2b7/ouqqQO2XW9zW YUr/VWU Jo/kaWZxBCCa/sxJRJegowSJ3cmB5UXvdnemufoJz7Fr/P1G4spwylXK4NQdJEzBq0/rfiEB1J27 x rMjvHfFddSngf8AJP9vwkIxAs=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.vaultschuckleapplication.com/c?x=ijZKx8LQd1 BunbzyljDdmpNqgAu9nhh2utKmEJV4T8=&c=W6UfFAbJOhyEEHtd4 9ruhWQj3nKHtAQBhfSBplndSxFqodlh cLFTPjGlxSJyBjjH4C/i/QylEzl2MJ0j3csbvvU6vs32spH/GEkr67q4shP80yGzkFjD1wGEQcigzBhyqueD/iFmCOF/PKh/Dx90R4i X9EnNkD92TFq8rvYA=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.bundleflashapps.com/c?x=Gs2EYoqm3E5vAYRFUSgRGoh/rE6dl HA4PdDIULXEIE=&c=UQi8l4vPPR1n3BQ6ypvxD31sAmVe9u2j3uAbpujalDI0Z TWWRnoyiDq2BT7XNjeP6obebbdlMiZPI1Vdsdq9iJ9bV4cseTt20CK0rGzeaaeCe1ULPakUhH8F6HuQYYgFSyhMgQUZj0lwsNsq2 IxOASopue79rrInQ6QWU bYo=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.grabappsdownloads.com/c?x=S35tqTgNil42eHs7ys9G5w488GXCLAhRcbKaoiJa2DE=&c=q8FZPg2sKyk6xBNsCXlDQWllp4qNHRuKf qNxvdWi5 eu4yqZynspcaeO XFzjUF J/xAz37O4xqQJKUFKfND05zpxL3Hw1wqrJG43 tySHqmqnRHjuUq4JI5ETDNV2eEvjcB9riVwF5 ZhuE7NhF4J1olIjUeZmDj9Ag/0uRD0=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.stockbundlecentral.com/c?x=yFe2gOiLpuquqSLJU4RFHkpwHwPLhfaUJGN82lgn4h4=&c=d17BRFJ1 1gTCyA1s R1BoQVYJF7r83LeQy3LbCfsASL13X4omGiD4GpdJK5Gla5AfNdfvJxXaRf8WBXlHuqhRGGsJwxijJ 7VrjmF6cia/hzUVkVjsIxjKMeYGoy5s/iMWSnkLhwoWsxnan S2K5c4LBexAGaiu6YC0307XXQ8=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.worlddlstock.com/c?x=8GUDyKzMncWpZnn8mvCdQExq3Ar5Xg4U/wTZUQF0hrI=&c=Qx5L74uehMxHNjss24U/ICvzPPfngmpcub9LTt9b2qJ7Q7vc00CtmVvTqF5f0EGHBH6rUBDGDmwOQwmbQpd24VwfZsjf2NJaOwc6uoIVXTd9fbSDgin9yRCj6tDw/55pgnnbZjxh7QFcMSuVCNQXBI8yDU57dnj6YMlSCuOr0sA=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.tagtowerscapital.com/c?x=xHQLv io kL5pdVuknVDIkAMDoYvkVTDzOb0eqADai0=&c=4YGcT87ewA5VeMAz9CO1OyzId1R/2z05KmFs mIZFj6YjnbIqeRMTOMa5RDi N0LnMARRhVQK1gqNPwdvvc3QzlQVBQ/a5kyl 3fkttfabViaD5FyjzMPQsx 2QbM3xFg0jgcUezOFszUc/Gq7nr FjRYU0Z4Bs1Ei140HMZZuA=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.bundleflashapps.com/c?x=x 1oad1j5M cF8UO9UtgJdXq50m/JL nP3j6bve64cM=&c=k0hOk 4aq8Guq5mVCAbDJXlGagIWeVU59dkVOG8UpXx hqAN2YqCrqpWft pg0wuLBxBKaGYcLrNGhffID4HUhnzeBort3u 1jg75LJjp/1uuLnsCJnF4qrWYMd/1XNXcwMnC3pWbPT0dGbrWmsSDjtRgi76myl82iTGJj9MOak=&e=0&fallback_url=http://storage.dobreprogramy.pl/.../DTLiteInstaller.exe&downloadAs=DAEMON-Tools-Lite-12708-dp.exe

http://www.worlddlstock.com/WVl6OTRQWGxyT0RsVFpYZ3pWa2xNTlVFbE1rSktkVmcxYlVKMk1UaFhVazFCVDJOck5URlNlak0zVm5kNFMyeHFRU1V6UkNaalBYbHJWV1JRSlRKQ1RrWTRVR00zTW1kWFZXMDRUVVpSTTFsR01ETTVNSEo1TVVsQmJIUllXa0ZtUjBnNWJreDJOMUptZDBGaWEyVjZZbU4wSlRKR1UyeDFTV1JpUzIxVFVIUjBZMjlqWXlVeVFuZEpZMjFSZVZsa2JHUmxTWEpPVms5YWNEZzJabU5KTTNocFMxSTFSbWxMV0VOaFFWQTNjbXBXUlhCbVJsQktOVlJZYkdaS1dFOTBRa1JaUm1KdFYxa3piMGh4VEZaWFRFeENkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbVJGUk1hWFJsU1c1emRHRnNiR1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVJCUlUxUFRpMVViMjlzY3kxTWFYUmxMVEV5TnpBNExXUndMbVY0WlE9PQ==

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_daemon-tools-lite-12708-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.