» logitech touch mouse server.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

logitech touch mouse server.exe

Bechiro.Installer

Bechiro S.L.

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application logitech touch mouse server.exe by Bechiro S.L has been detected as adware by 39 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.exfilesdelivery.com. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.

File name:

Publisher:

Bechiro S.L. (signed and verified)

Product:

Bechiro.Installer

Description:

Bechiro Manager

Version:

3.1.20.0

MD5:

87914b1e4dc0d90ad80f7136aa1a7be2

SHA-1:

201cf5f139558f23927bb439cb5cf287932a705c

SHA-256:

1b66f121a47df2f914bcca12f6b7186eaf8d0268d673b65cb01b15e1501739e8

Scanner detections:

39 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/4/2024 6:38:14 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Generic.692267

888

Agnitum Outpost

PUA.Firseria

7.1.1

AhnLab V3 Security

PUP/Win32.101Alemi

2014.07.30

Avira AntiVirus

APPL/FirseriaS.A.1

7.11.164.128

AVG

Adware BundleApp.GN

2014.0.4015

Baidu Antivirus

Adware.Win32.FirseriaInstaller

4.0.3.14831

Bitdefender

Application.Generic.692267

1.0.20.1215

Comodo Security

Application.Win32.Firseria.MAP

19026

Dr.Web

Trojan.MulDrop5.34677

9.0.1.05190

Emsisoft Anti-Malware

Adware.Generic.1002535

9.0.0.4324

ESET NOD32

Win32/FirseriaInstaller (variant)

8.10173

F-Prot

W32/A-a2151e6a

v6.4.7.1.166

F-Secure

Application.Generic.692267

11.2014-31-08_1

G Data

Win32.Application.Morstar

14.8.24

IKARUS anti.virus

AdWare.BundleApp

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.182.12911

Kaspersky

not-a-virus:AdWare.Win32.Fiseria

15.0.0.494

Malwarebytes

PUP.Optional.Bechiro

v2014.08.31.10

MicroWorld eScan

Application.Generic.692267

15.0.0.729

NANO AntiVirus

Trojan.Win32.MulDrop5.dcygsx

0.28.2.61148

nProtect

Trojan-Clicker/W32.Fiseria.521408

14.08.31.01

Panda Antivirus

Adware/Firseria

14.08.31.10

Reason Heuristics

PUP.Installer.BechiroSL.BB

14.8.31.10

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.3

VIPRE Antivirus

Threat.4782980

31208

Zillya! Antivirus

Adware.Fiseria.Win32.944

2.0.0.1907

File size:

509.2 KB (521,408 bytes)

Product version:

3.1.21

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\logitech touch mouse server.exe

Digital Signature

Signed by:

Bechiro S.L.

Authority:

Thawte, Inc.

Valid from:

7/24/2014 7:00:00 PM

Valid to:

7/24/2016 6:59:59 PM

Subject:

CN=Bechiro S.L., O=Bechiro S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

0DE376129471B42CE6BCA90326047A34

File PE Metadata

Compilation timestamp:

7/28/2014 10:19:03 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:eB+IjTW3biPEe8qSesh0UdNzx6zbZj4T9nF4:eB+QWmPEehSesh0+x6zblInF4

Entry address:

0xDFE8

Entry point:

E8, 5E, 6D, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, 5F, 2C, 00, 00, 6A, 16, 5E, 89, 30, E8, 03, 2C, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, 29, 2C, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F, 5E, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00... 
[+]

Entropy:

7.6364

Code size:

116.5 KB (119,296 bytes)

The file logitech touch mouse server.exe has been seen being distributed by the following URL.

http://dl.exfilesdelivery.com/n/3.1.20/.../Logitech Touch Mouse Server.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/28817850/launch

Remove logitech touch mouse server.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.