home

mp3rocket_setup.exe

MP3 TechSupport Inc.

The application mp3rocket_setup.exe, “Program Setup ” by MP3 TechSupport has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.mp3rocketnowbest.com and multiple other hosts.
Publisher:
Program   (signed by MP3 TechSupport Inc.)

Product:
Program

Description:
Program Setup

MD5:
e6fd59a0213e646cdf6a21408cf30f9b

SHA-1:
dabfb92da3afac2fc891948685434c8f21e21426

SHA-256:
84942ffe099188ffe53b18e199c499f1f2f11f5782f314413a160927ccd66db9

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/25/2024 1:30:06 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.2954

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.151016

Bkav FE
W32.HfsAdware
1.3.0.7237

ESET NOD32
Win32/InstallCore.ACZ potentially unwanted (variant)
9.12416

Reason Heuristics
Win32.Generic.SCCE.Installer.Meta
15.10.16.14

File size:
1.3 MB (1,377,536 bytes)

Product version:
4.0.2

Copyright:
Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\mp3rocket_setup.exe

Digital Signature
Signed by:
MP3 TechSupport Inc.

Authority:
COMODO CA Limited

Valid from:
8/24/2014 5:00:00 PM

Valid to:
8/24/2016 4:59:59 PM

Subject:
CN=MP3 TechSupport Inc., O=MP3 TechSupport Inc., STREET=701 Rossland Road East, STREET=Suite 363, L=Whitby, S=Ontario, PostalCode=L1N 9K3, C=CA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00942502E50B09BD176D7FFDEDA742A257

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+jn27zuLavIpaNyveOgYLiXfWI3/Ey1xmt14ZmlSvnqc4LD69XsuA:+z27K0IpaIrgYOv6yg1OmwvnjLk

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8773

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file mp3rocket_setup.exe has been seen being distributed by the following 22 URLs.

http://www.mp3rocketnowbest.com/c?x=PBJrmXx951JG4o Mj65CoBrffOji7awtWXuZJIfzEyE=&c=tDgTKJlKG8p2GPD7WIh BW9aOi9vpeS5UAq0YgoJzS9EGArBr0xGnNNVjKIVDVEUWadFyah0PrAnIM7jzaY0ivYmyIGqWVjh1erLmu4Ce5ZU1djWzeWIQJ I3 jZcLR8qfV93Dg4BKyHkJeK/ERmhw==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=txj54 5LvwGJ/LID5xQQhMuZ3G0EPOtgK0D7Wpidcec=&c=Qop0vgpZuT5SA/KZHAd3se/LF6Vo3eMH4s67IA80xbbx0AKvaMdhoF1S2bW2ItL wbQkxpKheCf4DsBkAaWjoMBtaxo5KLaOiDMQLiwqdyrKfjkObK4WA7qU74y8n9CDFy4kKQUU1hwJWimXgtE4JA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=5sBs0t3Zd3OYWCfWHQNGVL2gVc2nnKwbT0uQOOwmlQo=&c=FrjOE0/2Ah0Lx3hgWRhSvYxc6c9I0LJP VGjZJxlbjJ4N2GSiXuEWBdooDDBB36rBNQfkD TBoo7I245IuFL/XOwCqDLLapl82CBZCyLyKNMAdGWNtTYFdJsm/FA6VtxGCRUvkyVF8BxKLYqgJVF w==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=IdZXPiws5IqMmkEfsQHxgsupBSScqnfpxux0BPpiYqE=&c=g/iPFaYSusrznLwAp4T4D iIlnwmeRWIlZmmx5I3GFLHa3Uk/LfsMitL Gi0ph14sGEtmXcC1uAI9dIo8NmbizfViYCQmP2TZTNVNX7aWA1FdTSKjACMiz OU28N6lGXngH5m5uX0LjVSocu6kvH8g==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=OlZr7nld0MPr nJr3cTDRqrClXkSDFdUpyz1uPl6Q4I=&c=y0 MZIj0/YoRLrsMfaxzFQrCOZtbijOYr 3Z8y83GmYNvz3IKlO28sVcEKInsSa50iFBvLUSoKbTiLXTc2RbSgEK53 lAnY8FAaqeltvE4t6Q3tboNo5Fu312Pac5H5It uVGu5j8QCnH3/gPpT0dg==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=jvy0ltNL7SmhNlgE8ruFi6CQ RIHcxbc1zAp8nlqFos=&c=U0NF8O4X9Fq5WrIXBxVWYtt/uwlGyDkGs2cyCIh2ayDS9/CjfxuNXwDF7Ee9UE8XlN4o 1bUieVSdZl1/eGGxs5IjlqPslfog1t0fqjwq0/Sx4sqOjSFtxYXedarWrZKUmQLvbUbjAcWa9EZBiI5bA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=i9Pgph0Eb5Kl107wyExksxwiNzh2dCfFvUsUwpU8kdY=&c=zYU8sA 3Db IG9cfRlWvFKWe86241AsiHIS2jF6PLMSxEQZTuww2OaGf nEO1welNnST6 0zbhKgUGsdh5p8sygUlriWM9t7VVtgK7b5aMms6 OvRH76L9F6TWdXqgyg/uGz/ADsSqC2YNl2gVWZQ==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=Kxnisk4r7AJPX3dKaY4cLUX3SZQmGYcYtxSib1x1vb4=&c=fRr NyvQxGLaU6Qticjm56V6 /INqD/Wl8qBlVER10Cv LO iC9lwsSCPrSW0CETgVr5rp8uGMJu6nkkoED thrS0iuTQilfiJ0uFXunZSyJSbgwwyy9x0dcnTKCpUSfT6iCb/0EqIyLz/g/jDMH7g==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=FoZ7nyuE8SPitDLUWzZQ/kZZATrLC7Dsh70Oxq/qfto=&c=U3QBIAKdCBFGkwfwQmW0PnzXXfCfkLf5DEhrATAPgwLpB6wc8H5OvgqfdHpyoY/X2LSTp3oA0lqgtWmvnVS41uJijH8rnUUWhm0dvZ02EczVp2wiMQFGjajMeiox/MI35sUMitsNrHSjxZ20uQeYMA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=bNB P01gWrmwiKEysY6PxGhD4O3wlndGKBaeJCceidE=&c=OsK9vw8E5Zn8LzMmtbxZLNLuiwdHb2/2c T6Nr9IaSZA1aSmp82gA/pcD95vSRjhAkICxoWrS9C viKFgAN1LKVEWsawkEylUKrgr3DISGy/UYSlMrfj1HnnCsTAy0 HqRvd7FSXVL4vIh9RtS1Fmw==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=wuymezsVGWRp0DcIP0Axm/P3Ggq2N2SPFi3w6AYrl/0=&c=D4uB5P2iXFb5lEN1EuZjv9l9B/8K6wiSMGfYvLqPhlaU P8VOlHMGLTCCU547imhXXImLKTW5FSL8XkbOiYX8xe1tHJkxn0NupIwQbLaD40nZbeue4IzW191Xt0I2D4vE5MEtM3DE1JSbd7D0dO/xw==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=B2KiDdOENBzgxPW/epvsE7GMv7tW4PsJuUBTFDy o/4=&c=uemYYhLVhs1HaHwp8uCDkUpRAw2CkrPb5mCtRdLTC4AMald/nLe0ntp19sn9tgQCDTpd9/ l/RwvgdW K9EVeQmdkrPxQFVy7olmjEgJ4Et6/uhPml1xUz/h6dsuc836pzBAYgKN7J00II35egRXnnAZmPlaADoek0v2MRORH7c=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=MTSddiLQNEcTUdosq0sHYmmvthpaHix3kAyBdkI j4Q=&c=XPdt6kQqdi7LIzGELIk41wVFoIKUJbRknaPeXfCQXHwC97dPzIVgRt8r6eDnKC2rqgsVgcNgXfEBefLzR3JmmmtsGIKo XFEBtwkj9xdkytEFRLs1vxxjkbxPaFN7KwhJuWb4T /BPWkT1Qo1GDurQ==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=Q0O1RpEW6ouf25xqzcyVHGy K9QWtn25HrYwHkyVZpM=&c=Pq5NCklWNQ8PBSEalJlYt/nOeRYVjRV/ZC0lOWfwr5AN/ivn90Hkx75p6JJhFQyB2C2cstVMEbckFbJ1BW7T9U1QghsHUFl58tXog5eb/nQ37zXCmKMsTz519uF4imJIb/Btq83NkewFa97x2nzbaA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=O 24IRBIG34mLqBn4 F4TgPdVCi32Edwat4RR9LtBds=&c=TLeyRiBmn4ytVpVJZ17cPSDrFBBg9usURQ/Z6EhVvu1ip6xakBbPiTUg XmiJchy/A8dgmiC2mMZ/d7y4UG2SXHijnWLmnL6ZIrs0pgbTQgMGSx/D0jDr0xsOJsbOVwsR RntS0z/m1AiBU1ucjaQw==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x= ukl2VIqFd3OjIR9A8DAsznuGVNMzgCGHqffsFHSEiM=&c=hkv7H0eMzd0B1FfckFhdhELe3pxun hhlkq QpJlqG2I0LWhxzuKoUSvnLAg6lZnkLkazJWFj2OqWXRhWCHBZwnvdxDQCtmV2jagoyhB4KGgxEUpHUh1XakTdnpqKZ9uKCUB8uLGiZEFG0UfZs9djA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=pvW3tUq1W/4uHxhYKWufD6INg5O34GOBe0Yw/lu0LUE=&c=pOeGYSMVZd46h7i8DLyfdToTJJwCCeWmRXza4Qibmk4CZKGNhodH5KiBoAOuXXUN5CLU0FjJ98ZhL/wF5L2nH0uQtPgwR6gv8beugxEG4VRVpDi3T5NqofVrad/NNz2oL0WdrPfnE4wc58BHQnsM1g==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=gRCKO/tBcWnzlAqjSUqc 6l70kcSzxR1B9jdM fPWOQ=&c=mtxzQIrygPV01694p8bM6jQrsAyPF7F9Q78OFugYTMI/6YltuElTDflbqMxxH5wPf7c K8IifnqTQL94DhkrdW6MptjOLB1vfCeybrolAhbYXkO/Z79FIEvTheg6gbHj8ooTFDmmzIJZ8B6hd6T1Ew==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=iA9WBgik0QtqyS26Fm52o/oidKG73yN/bmBdAo42us8=&c=qKJ2dRr7D0qc0RzttGw92wGADH2mNhtTogFWXoIb41e3BMEeW4EUg6Wjm1kBx b8Cio8Xy8O78UrXK6z17wDdDF/2dk0quLSYdy69m4l hOTHrOuOmyhuD9w4Y3TfpB mpR/CaojRcCR8EjEju1BDw==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=RjUncuZH815hyZRBHasd4GJTTwmj3NbzQzk9NsHmimo=&c=/lHN6xDlHBiG9Gh9sSc2sZkOlPJxeDANISC0JXb P1F gOzeUPMIGJuxNaOw1k7MQZWc1kQ9r IMMI2g JkvVovbzzn/ab3LCt/BZlzwNNXTwZf8Q64SSUMe8vssd4X1ngQznAwioQvtqXbkOTGXxQ==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=nKDkEGovmE9TP77tUUIrO4BZgLOAkMYkjBw2Jf4Pm70=&c=xZgKhjsSPs7TU7TKJODGKpBArwrMOwOs2cS8dfkeK2eijMX4ibrX671HMEPHth/ae zPKCoaUEV6AUDmtjGl9pXFJLF SIgDWODbMQ8hvl mS Gy2U0PmJnwug5 T6Yi37ih9ix1LEbFiDZtKwX2Sg==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketnowbest.com/c?x=53wEO5eoza/mR6 TzVioZ6L6dvJeFaYBkebBKiH3MT8=&c=IYiWCZqhm8eWxXu86yCbd1VcAkAS4vH/dY8Hu2Z RnBKZo8MiS5g6W66JrHA/4/E7XE72x/GuU4BZ8Bz7GFk2xqQK8pQ0UEOkBpFd5aheWjeVWRblQ2BRhxlXKMB1Ox5sJaJjevOAB8SwgHFBdJj4g==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.155:80)

TCP (HTTP):
Connects to 92b91b35.rdns.100tb.com  (146.185.27.53:80)

TCP (HTTP):
Connects to ec2-23-21-150-180.compute-1.amazonaws.com  (23.21.150.180:80)

TCP (HTTP):
Connects to ec2-54-232-235-7.sa-east-1.compute.amazonaws.com  (54.232.235.7:80)

TCP (HTTP):
Connects to ec2-52-67-76-234.sa-east-1.compute.amazonaws.com  (52.67.76.234:80)

TCP (HTTP):
Connects to ec2-52-45-150-52.compute-1.amazonaws.com  (52.45.150.52:80)

TCP (HTTP):
Connects to ec2-52-30-150-214.eu-west-1.compute.amazonaws.com  (52.30.150.214:80)

TCP (HTTP):
Connects to ec2-52-208-40-227.eu-west-1.compute.amazonaws.com  (52.208.40.227:80)

TCP (HTTP):
Connects to ec2-34-198-225-71.compute-1.amazonaws.com  (34.198.225.71:80)

TCP (HTTP SSL):
Connects to a23-7-125-208.deploy.static.akamaitechnologies.com  (23.7.125.208:443)

Remove mp3rocket_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.