home

icreinstall_setup.exe

Rutubo

AVSoftware Ltd

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_setup.exe, “Rutubo Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Dom   (signed by AVSoftware Ltd)

Product:
Rutubo

Description:
Rutubo Setup

Version:
5.0.2.1

MD5:
e9b1c1a5e8708626a7467e60f9e02ae7

SHA-1:
b7dbad566d57bd6c4978f52acb73be019e16a1f4

SHA-256:
af135d3905142368b35d66fb678b8f51421063c644d3d85e309ce6ff15745bfc

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/5/2024 9:34:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.5.10.16

File size:
968.8 KB (992,064 bytes)

Product version:
2.3.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:D6WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:ech10ZO2OuUu6H0rowyfD0

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_setup.exe has been seen being distributed by the following 50 URLs.

http://www.conceptssignsfactory.com/c?x=5Lzk JJ6oAj26k/sT2gl523ZtHxGvogBNEC3SPDHC9g=&c=NWSLrSjofQwPg07CTTdbZ0gd9eSuWPvwBveMaLFIJgIEWPsGq2GGkKl2tamzsledupDVJaigMKeVW0w9xf7uG79fQ kNHqK4DGBG2SxPProdEBYZ9ERp0MSQJED53X98&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metadlconecpt.com/c?x=b2RoxYXM68mVOUQaTvV5JzKhS/l5LN5p3Z/khrNA1J4=&c=f4LbBsXDb4GXA9UEvKFNUStXWmqUwxwnuDAUwnPZFE2KuF1uje67SSdBedssRtL9BzTcJpCV7L2aA4C42bX7f53ogTTZsCA644y5BDJtR6/c7v0PRHpCHaeMlxv4OolF&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.tagfunfiles.com/c?x=1PeGBkf4Q0vDqWyzLq4k9zH3Sk1EIz/4ld08v3wgdo0=&c=JJkAAN1ZnP7spch0enxomFYolWuVJdSqE4Xh/h0VsZBMHOwuvJiNu6752EvYg41aidqEP0bL/n4WtybJd6RASjNlHBPZqTfc4m1b4oBdjQnmFtYCTG lzhnxaokBC2QU&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwarebestconcepts.com/c?x=6Q960ofrQVPSjo5ezxqf1s rZ5MOOSB9VITfCH5W 74=&c=Uw1kqayDTytp jSzXh79q7ERjNrbDmMuUE9Z8g2IfAtt7jHgQwSF835aMOL7eIROPI8Kec5YMaKkMdLSoaZcYzzDFYX6s0pp1L1EDh t6lFgn8LVGV3pF sIYaEL9Y8I&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorybulktour.com/c?x=w AaUybXmuHMMFXO1F fvM1I0sNrwfJobxYtxBCeVVM=&c=MPfDwX6IvkKFcak6bPi/j5I1XzZWvX/K3FaZUmnmwUV8N0qJgSacNrTPVYwmA1fIc6lLeX2RZwHnSa7xzQruQ3hg6SjFwePQbmiJQ8TI4ZUSx0UKZSkOtmwfTlY0kDuU&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.tagfunfiles.com/c?x=Pai4B3fZqd2WmAwkMC NiUgISv2V eEieOhBVol Y9M=&c=zFBMSYzR7wD2TpU4QLF 1L4UEvPO6NhrbY28zstNmuw98LcebtHyvyxjT1P2azjNwgo90oSn81xJrbTmFbIbretXEzOtjS6bFXLAqoJd3SqbMyTlH2KNA6ZlHbhc2kmQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.towervaultclear.com/c?x=2eUiMQI1u9V0qv9tjsRB0qznO 7 Vw9or F22d158pE=&c=R1vJHZoVseeaJq cAc3f7GJAd0t2BvvxqimiWIE/Q5wNFywm1ATtFoa9pGQy8wiZu423iclkPkwQKN16yegYTljZg2rFXFHvIJq9JO4vHxdilVDZ6T0J6HXelcbMxyam&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.dlappsbody.com/c?x= /f2RVSAilYbyDhR3XjwML8flSVBKSbUGFB73oBzzUc=&c=fO9mnHR7mzGy81MbE4Id4/f/sQD91sdSmRXDTMDyzclcnAX0y6FkWODx fCB8k92wLqT7fxIC218D08LZ73NLHPdFdQabHSHOPLnHb4qUWbyf/Z7enfYjrmy9sT1thnu&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.currenttourstoday.com/c?x=18Cdo8KBN4H83WNrZ4zQyrOmOtNH7kWk0ta HniGchU=&c=afpw5aAAtqnWujEQkXpMQ5Ry Okf8VKSK1qsCMwuWXhTbXrZfAoym0vq FEYWcueiLn5pGW4OK8fON0ZnbRujHyCjaHQcRwf9NVI19Bl5FGM7Qwm3Sl1BEJGOzLCAF0&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.stockappcontent.com/c?x=Is AjIjlJc8cDu5RCf9MdimjYdXJ5FRLzbGwLvSAaXY=&c=VILjDV0JGAQeC1f5cZwNrzjFyubm2ufeJLnBrw1kbU46qDwc3QkkUTAzlCqbhkxpc2ZCgigCNARkdmufe1UXIaBpkhuasAXilr8Ns9SRUBiQupeafEXUwiNPj8 AmGi &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.conecptclearbundles.com/c?x=rA9GxI hyZBveZt5BxRavOQ6gvEFtktXour90Zz7ngE=&c=iMA JbEwssVaE8IRU1M 6o4aIMZH5dZXOwDcGE54nSaChr0bjcn9LPaphnm11YTEBlTLxpbkzlq7nxhd3Hnajx6baNI4EfhL4vCYsUdkhgHyr4DmwZeQFKeb4KV2Xdp5&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metadlconecpt.com/c?x=QhmQsGcqgnRungSQ3Vd3JjpHuzLmkyJ4QKSRzNDFRa8=&c=hlcaVduUgias4d/3PkZkKxUg3HliZzjDhCi6mNxrqoWtMWbOIL2AmyQSxOtv9sSddsy3s2w5pXTMP Y9QeCFbV/xRmWYwgV55Q9z9Cog7fAaHFpTd0bb6OsUH/mSD/ZU&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metaappgift.com/c?x=cmCo3dj/HVKnvei2ypkwuouVRQlAVlfcBHmDoioVPlQ=&c=sXoeepLwalWcn4Dlj6O8ffV/i7oGNBJI2VCTQdoJtt1wJQHdzbewcFZQTJr7bsTV1ZUFPFiy28XiwMGD5qy2kVBfAyZSDKg/1MkoIf1AlZp5B9VjpfyWeUTmIk yU4J8&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.conecpttagnow.com/c?x=oi7rlbfn6GbbRXEk/5fhy999Qks3MnrrZVQj2oCjWZw=&c=sW0Pdu/tGp5HhMKZ1D7WfDWwPQAmXoZSRRDqpmUwlp6dKKleMTqBsGBCiKKcwsN84ivU 7H870iCw2 cCmAzPcqcIWaXid58LVhYxTkiw6 OyMlPIqGSQpn xbdFGmjC&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorygiftapplications.com/c?x=wVIkn4RQ/p7kUbVfnrXfyIO R1LPnjNf51tDje46zt0=&c=t1EBQkrb28t17ORGUFslD9MHMyBREbDiF1nxI6NNYlR5oYubUxkPGg7IDtnXT6wCd2YWc8vQBupnNFx0R90O0V7Obuj6p4xvfREPJvOxJ PlEhAgYOsKqkw53E g65pF&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.sendcapitalflash.com/c?x=8 qiIIHzVAQTK8Y7NvhtdbBqi/Hv5o3hof8PvQQt0 I=&c=OGCy6 fIZXUd4NNrgiFsQ7i7yYzWqaaMVzO11XfYWISuMVar4QgnLRTirHcyosZ2Q j9h/frO/AQB3XicdkFUsho1W7uXHcp/M/ivUwhqUSNnLJicXJzqL2ZYCsoyu8o&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.signbitsfun.com/c?x=WvZHSiNdmdrVX7 Is5pP2m4LYtLINl74UDw23LAaimU=&c=ZAyuQ1572xDyD9JMEmyvbHT2k/dALNfxo1tVfUUlWwmitoZYbDIkFo0n8gkOtLUpGyQltHoiyknz7LGbn5 ZOWDvrJmv0o6wILcHDnsfbF k9IlM27rxJK4FCJIL1d2/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.cleanbundlesmeta.com/c?x=n/V v TaMwtZhLiGT T240agXHwlr6HA7qwkMcz7 XI=&c=oR4kBn2LFV6g0LPkW39ynapcux53Mqc3IdNtk9nyEY0hkkipN6pkT35yALZQJCIMXLIXJqwhRBb0t9xYzs7mAQlo2tUyGUdHqezfv0bNsJ9n2CzXB/H PHwRCoxp4Utc&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmconecpttower.com/c?x=YFoh5WqsT3m1Ue5LgZOs/4ru6drB7INLEGEDKmhCWqk=&c=7LCZ5IVuUbYr1nKeLr3bdaTMziMWvDgGxCSOaqIG/2vLmJ8SnQdoOAWATxSN1Xpx5SOi76xmAyE9 6/8uvu/icYR1Kxlda QoIId0Ull1Y4KtgcswrrV4C0B9Q81Jvf7&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.towervaultclear.com/c?x=Mu7wWEIYF09rvW4iCfxzRRRM4BZQjBEIvvyolu3nbk0=&c=X9aXpJj0Lf8PlQGryTO6 CmBhHVelee/tpQmdSy9xi3599Rk8azYdtLp1I/TY5TqQa7VGseqf4zvPKCUHA7SPCRztBBpzVBM7EKmduJs8kCAIBKdX Y2qkw 8hFqmiaF&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.towervaultclear.com/c?x=BmGXbnmuZANaLRJcr0lWoAmf3TQ8vLFxJ/jCpNEYN w=&c=AJZyxSoBg3Hx6lv/lqX2kM9HI0dcmJ36TXEi71bUqI41JMKhT2BOFij7Br9H ICIhUCqg05ux5UEelulb zJj/9AFzwrcXN3rBoFA0rqgJCvqnogfI9GIqwoGsvSt iO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositoryhostingconcepts.com/c?x=Lc14D2T4bE6doxtv5e8B7sxOMiHw0/7zIPt1g7j4Ids=&c=HVXDc/0s73H1Ip3QsCIN5R6TXFZgVlvGFV4JBu2KqAjSDnO2DO2A3Zmul5vnvfXWm RHkjYtS72M5dauLIOyWM57x6yXBb0lVK038y6ManTBVl0oyFvu4eclv3qk9TxO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.updatebodyupdate.com/c?x=ar0LPGR9Y2Vyi utYhpj/Ge/8Mf3/q DFkBlW1VeAt4=&c=oEIyEeECOcTJOCJPCWgTqWP4uELtxygTOOUbM8moi8ipGykSYhUNtQ2ugLMHkwE8Hbw9OL 9TFb/OY1A BLGBzyqyVTy4WpY0hd qpTJ/SFg9EW6M7Hv8AcBa279SDXS&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.conceptsappsranch.com/c?x=K5hnYq6cITDSKl4KBBQE afhXjdTeyQ2sYlF8hEN3mw=&c=wwHOHOvBIbQO4PxEZgfbqSg31HTtKaq6BkWsmSrRjGTOSIYUHOIyQHC2APsjztt/S1bby6/Z5GQwGqiJzaphG2PG9LGZqwWvCouKVN0VLViscI/xk zy2ukXTNYzGyGW&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorygiftapplications.com/c?x=dlcTQJ0gHWbkxfGncaYCv8Ww0jCDvQ63LSTqefddcsE=&c=xvYLlCcZShqYs6kpLOGDLej1XrJ/fMN0Nl634nMi0vR7oMWdthNpO fzhn6vTu 1CevrYI DCQtcJ3Azqhyr/Zbgp52UDZUelMPv1S0FJp36HNyinFaOOSSedvVZF7fQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metaappgift.com/c?x=U9tSWGOHZoo6p3FTUCK4BnM kq8MmoLys BITfFKtJY=&c=H/W3cvWvne5sBiky sCMPt4xAgJCl 8rPU2D4EYd9Kr0z7UEx/sWY35UUZgP5xykIE3/3GwHU3PKtxPwPqz9uWx79b3J8Xt5mINGdGmzdqETJEITDE4xEJwoOAUWPWor&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.conecpttagnow.com/c?x=kB3iYVS0IPub5uKqzY5RnEv X0HkyDng nbs 2Ktb8A=&c=FQLKNmM V0R74eFH JBxN8Pjijtxs /jL2RqNZ7sKlhWQ bt6NioSLTlFi2VNMwDTsutmSLGinsI2D4h9dXEtEg7apf4yKGO8b8gyB03D3Y75fMXPPi4ZpW3 Q61Wbyq&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmconecpttower.com/c?x=yxhgCYdCTAkLbszOOShVYpnDzdRIG04jjKsKLpOnFP4=&c=TwgPiBu8ZRkOWRGv8lxcZwZbhs/m4xR2vRGVJs1c3Yw6SF97TFrUs8n8kpzPYH9YcBIl2ln7OB2nqjCwPz6o3dqjNWBu0sazVbIQMAfinAes0608sSa/2xKYURmqiCCs&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorytourslaboratory.com/c?x=CI47Mkk5tpaJXPNdBc0a pdH3 4aQrpkLxytBQ8LaFM=&c=6ILHturo5rtJYC22LMgeCgaYHRedZzu49LXvDb8B6zAhXYnpP0GG2Zp7/G9rFynFiVJVi7yI1sKkiL DKXBbcyVcN0 NlJIMeqLQovXtgvl7nG5UqFzVMp0HEREJotEK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.tagfunfiles.com/c?x=SsIxz672LZ75z7Q7pT27sQwqW33Fc/8qQe31f68DMpc=&c=9 amt/RJ7obsRMkNwwNQlVKVosAVSWitfvx6nMWlRdkOsbi235WnJk3KUYbXH/S1AIrea3J/XJUHOEF63DXurfUsQy4QHi/LQR8qItpHDbsihLmB8XSVvwjzwtetd75c&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Latest 30 of 108 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.