home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 14 anti-malware scanners. The file has been seen being downloaded from nym1.b.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
5908633cb54823f19669cfef5374b673

SHA-1:
28ed168b5e97ce33ea002f7a9c12ac8e584d252f

SHA-256:
48d210b7896fd724d66bde18d42c56a4570b8a4b7e77e657e100467b02af437f

Scanner detections:
14 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
12/24/2024 5:10:21 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-141002

Dr.Web
Adware.Downware.5822
9.0.1.0275

Fortinet FortiGate
Riskware/Agent
10/2/2014

G Data
Win32.Trojan.Agent.4P134N
14.10.24

IKARUS anti.virus
Trojan.Win32.Agent
t3scan.1.6.1.0

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3162

McAfee
Artemis!17FD46A07B73
5600.6989

Panda Antivirus
Trj/Chgt.I
14.10.02.01

Qihoo 360 Security
Win32/Virus.Downloader.8e5
1.0.0.1015

Quick Heal
Downloader.Agent.r3 (Not a Virus)
10.14.14.00

Reason Heuristics
PUP.Installer.Stepitapp.F
14.10.2.13

Trend Micro House Call
TROJ_GEN.F47V0516
7.2.275

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
33586

File size:
407.1 KB (416,824 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/11/2013 12:00:00 AM

Valid to:
12/11/2014 11:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
9/29/2014 9:16:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:77eZZCRibqI59PpOPf201/z7pUmJI9ftRVlxmS79z:neZ4RibqI59Pk2cb7pUmJ0ftRVl00x

Entry address:
0x638AE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1389

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
390.5 KB (399,872 bytes)

The file setup.exe has been seen being distributed by the following 21 URLs.

http://nym1.b.adnxs.com/click?XJzWbJ-ozj-amZmZmZnJPxkEVg4tsuU_tR8sayBXyz84ktsCGF_QP094o68z-ghOCSHhOGQFwDOnBzdUAAAAAG-GNgDIAQAAdgIAAAIAAAB-hyoBYyAHAAAAAQBVU0QAVVNEANgCWgDehwAADs8AAgUAAQIAAJYAViN3dQAAAAA./cnd=!-gbTQwjz9MICEP6OqgkY48AcIAA./referrer=http://portal.mypearson.com/clickenc=http://.../st?cipid=168040&ttype=1&crid=2710428&dast=YnJzcj0zODQxJmJvPTEmY2lwaWQ9MTY4MDQwJmNpc2lkPTQ0QjZDMkU1NjkyODIyNzg0NjY5MjY2MCZjaXJpZD00NEI2QzJFNTY5MjgyMjgxNTMxNDc3MTQxJnNsaWQ9MCZzdWJpZD0xMDQ3JmNpdWlkPTIyODcyNjY2NjczNTcxNTAzMzQmc289MSZjcmlkPTI3MTA0MjgmZXhjaWQ9MjImbW10PS0xJm9zaWQ9NTMzJmNudHJ5PTIyNyZjaWNtcD0yNzgxMjgmY3U0PTAmcHViaWQ9OTcwMA==&cmcv=${CMCV}&tgtf=http://www.mydownloadhome.com/download/201?pub_id=90&sub_id=nym1CInChMfDrIHgMxACGM_wjf26xr6ETiIMNjQuMTg0Ljk3LjEwKAEwp4_coQU.&tag=3573359

https://secure-nym.adnxs.com/click?PdpH5justD_z9KTvA0OxP5zEILByaLE_8_Sk7wNDsT882kfmO6y0Py_E8WvIIOQ5st9lqIJkAV05tipUAAAAAGImLgDIAQAAdgIAAAIAAABx_SkBc5kFAAAAAQBVU0QAVVNEANgCWgClXQAA66cAAgUAAQIAAJIAGCosuwAAAAA./cnd=!AQecQgjQ9JMCEPH6pwkY87IWIAE./referrer=secure.imp-serving.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLK_l8OqkNmAXRACGK-Ix9-GmYjyOSINOTguMjguMTQwLjIxNSgBMLnsqqEF&tag=3024482

http://lax1.ib.adnxs.com/click?YB3A_ycaxT_3SZvMq1rAPwAAAAAAAPA_90mbzKtawD9gHcD_JxrFP3ZcHod4YCFAlM2-mTziYg0IWzVUAAAAAPtCNgByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAdukAAgUAAQIAAJYAuCMiXwAAAAA./cnd=!QgZLOwjCzJMCEP6OqgkYkt4eIAE./referrer=http://ib.adnxs.com/tt?id=3556091&referrer=${REFERER_URL}&sf7Spt2B=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CJSb-83Jx7ixDRACGPa4-biIj9iQQCINMjA3LjYyLjEwMi43OSgBMIi21aEF&tag=3556091

http://ams1.ib.adnxs.com/click?aRsz4txAMUBpGzPi3EAxQAAAAAAAADVAaRsz4txAMUBpGzPi3EAxQHoqbLRya0tus1QJ5vEySgLltDZUAAAAACQsIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAACrUAAgQAAQIAAIwAFx_4lgAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.win-install.com/geogebra/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CLOppbCe3oylAhACGPrUsKOr7tqlbiIOODIuMjQzLjIxOS4xMjEoATDl6dqhBQ..&tag=2239524

http://nym1.ib.adnxs.com/click?ksNFZgfv1j--QHojTybTPycxCKwcWuw_vkB6I08m0z-Sw0VmB-_WP3GCFS_dq4R9pIXklOXeUTMmkzhUAAAAAGncNwDIAQAAdgIAAAIAAABx_SkBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAAgOMAAgUAAQIAAJYANSYm9wAAAAA./cnd=!XQaTOwiGpdACEPH6pwkYn7YfIAA./referrer=http://moodle.njit.edu//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKSLkqfZ3PeoMxACGPGE1vjS-6rCfSINMTA3LjE4OC4yNi43MigBMKam4qEF&tag=3660905

http://nym1.ib.adnxs.com/click?3vlHsk7muz8ULqqh00u3PzvfT42XbrI_FC6qodNLtz_e-UeyTua7P1lfTtVshgBnKUImN003OGjjICtUAAAAAGImLgDIAQAAdgIAAAIAAADxzysBc5kFAAAAAQBVU0QAVVNEACwB-gClXQAAP7QAAgUAAQIAAJIAVCZSkwAAAAA./cnd=!rgapPwjQ9JMCEPGfrwkY87IWIAE./referrer=nym1.ib.adnxs.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKmEmbnT6Y2caBACGNm-uarNzaGAZyINNzUuMTEwLjUxLjE0NCgBMOPBrKEF&tag=3024482

https://secure-lax.adnxs.com/click?exSuR-F6hD9YObTIdr5_PwrXo3A9Cu8_WDm0yHa-fz97FK5H4XqEP3qzWfz1qVh-InKfPnbPyAFzMDBUAAAAAOJCNgByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgAPaQAAetwAAgUAAQIAAJYACCYzWQAAAAA./cnd=!6wVUNgiBtpQCEP6OqgkYkt4eIAA./referrer=pixel.mathtag.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CKLk_fTj7rPkARACGPrm5uLfvqqsfiIMNjUuNjAuMTU0LjY0KAEw8-DAoQU.&tag=3556066

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CL6g3pPj2eXLWBACGM3xt5vA_7jzKyINNzIuMTcxLjE2LjI0NSgBMM6s4qEF&tag=3604735

http://lax1.ib.adnxs.com/click?M5XJV1830D912t6UoCLJPwAAAAAAAPA_ddrelKAiyT8zlclXXzfQP834bQP84-YrPpB3Ms6Wl1hOljhUAAAAAP8ANwByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAA6uoAAgUAAQIAAJYARibAFAAAAAA./cnd=!6wVUNgiBtpQCEP6OqgkYkt4eIAA./referrer=http://ib.adnxs.com/tt?id=3604735&referrer=${REFERER_URL}&xKxiA8PQ=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CL6g3pPj2eXLWBACGM3xt5vA_7jzKyINNzIuMTcxLjE2LjI0NSgBMM6s4qEF&tag=3604735

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COv36cyHouuiXhACGLj71vj4hq20MyINNjkuMTIxLjQwLjEyMCgBMPWW1aEF&tag=3556091

http://nym1.ib.adnxs.com/click?pHibSqXMtz_l457mzHGyPwAAAAAAAPA_5eOe5sxxsj-keJtKpcy3P7i9FY83tGgz63uaeRCtRV51SzVUAAAAAPtCNgByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAhNUAAgUAAQIAAJYA_idOHgAAAAA./cnd=!QgZLOwjCzJMCEP6OqgkYkt4eIAE./referrer=http://ib.adnxs.com/tt?id=3556091&referrer=${REFERER_URL}&JtLXBWhf=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COv36cyHouuiXhACGLj71vj4hq20MyINNjkuMTIxLjQwLjEyMCgBMPWW1aEF&tag=3556091

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJ-g1MvZrunCAxACGJmGwsW9q7SjKiIMMTA4LjY0LjE2LjgxKAEwhNqroQU.&tag=3575299

http://nym1.ib.adnxs.com/click?uBYJaipEuz8K16NwPQq3PwAAAAAAAPA_escpOpLLtz8pXI_C9Si8PxmDsNhb0UYqHxB1mXWlhQME7SpUAAAAAAOONgDtCAAAdgIAAAIAAACCqB0BfZQHAAAAAQBVU0QAVVNEACwB-gCmzwAAirAAAgUAAQIAAJQA4CFvQAAAAAA./cnd=!ZAYLOgiLtL4CEILR9ggY_ageIAA./referrer=battlelog.battlefield.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJ-g1MvZrunCAxACGJmGwsW9q7SjKiIMMTA4LjY0LjE2LjgxKAEwhNqroQU.&tag=3575299

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CIyIgYqrmIG8YhACGMHMmLyslvLcUSIMNzcuMTAxLjc2Ljg5KAEw96DqoQU.&tag=3144696

https://secure-ams.adnxs.com/click?voPr8jDpnD--g-vyMOmcP_p-arx0k6g_voPr8jDpnD--g-vyMOmcP0EmhseyyLlRDERAscIEeGJ3kDpUAAAAAPj7LwB2AgAAdgIAAAIAAAB9_SkBJPwGAAAAAQBVU0QAVVNEACwB-gAlcQAAx7cAAgQAAQIAAJQAEi1sBwAAAAA./cnd=!1QaDPwjWg8cCEP36pwkYpPgbIAQ./referrer=http://delivery.us.myswitchads.com/adserver/hat.php?instances[0][instance_id]=0&instances[0][zone_id]=6984&instances[0][token]=T_OcxR7PcS3w&l=I7sEmUT3fV&bw=300&bh=250&loc=http://general.safewebonline.com/.../ad-300-c.html?ac=1001&ccg=0896fedebfcb4629895d436190398e3c&ns=SAFW&pid=132931&ccv=1002007031&hu=http://www.allen-york.com/&me=NA&cv=71&inc=1&cc=GB&load=1&epk=86454e22722e226d39bf4c6f538c8212&as=adshostiso&tzo=-120&referer=http://general.safewebonline.com/.../ad-300-c.html?ac=1001&ccg=08

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGIy_rpHdt4aeVSIOMjQuMjU1LjE4OC4xMTgoATDW9eKhBQ..&tag=3660903

http://lax1.ib.adnxs.com/click?oD39wiz68D8nMQisHFrsPycxCKwcWuw_-S1mwnQV8j84yjBAQqj1P4yfK9K9GTxVAtsCLtcFBnXWujhUAAAAAGfcNwDIAQAAdgIAAAIAAADxzysBH9sHAAAAAQBVU0QAVVNEACwB-gALiAAAztwAAgUAAQIAAJYAeiWA1AAAAAA./cnd=!DAa-OAiIpdACEPGfrwkYn7YfIAA./referrer=http://www.office.xerox.com/software-solutions/nuance-ecopy-sharescan/enus.html/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGIy_rpHdt4aeVSIOMjQuMjU1LjE4OC4xMTgoATDW9eKhBQ..&tag=3660903

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGKW2qbKOhJXZayIOMjQuMjU1LjE4OC4xMTgoATDv9OKhBQ..&tag=3660905

http://lax1.ib.adnxs.com/click?PvA-7jb64D-bd3inLVrcPycxCKwcWuw_m3d4py1a3D8-8D7uNvrgPyVbSuYgVLJrAtsCLtcFBnVvujhUAAAAAGncNwDIAQAAdgIAAAIAAABx_SkBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAAzsEAAgUAAQIAAJYAbCZcSAAAAAA./cnd=!XQaTOwiGpdACEPH6pwkYn7YfIAA./referrer=http://www.xeroxscanners.com/en/uk/support/BundledPaperPort.asp/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGKW2qbKOhJXZayIOMjQuMjU1LjE4OC4xMTgoATDv9OKhBQ..&tag=3660905

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGN6aqavr5-GOOyIOMjQuMjU1LjE4OC4xMTgoATDP9OKhBQ..&tag=3660905

http://lax1.ib.adnxs.com/click?oD39wiz68D8nMQisHFrsPycxCKwcWuw_G2UdeaJX9T_7_zBpRo_5P15NarU-hx07AtsCLtcFBnVPujhUAAAAAGncNwDIAQAAdgIAAAIAAAB-hyoBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAAM74AAgUAAQIAAJYAdSNUYwAAAAA./cnd=!jAZoQAjyxc8CEP6OqgkYn7YfIAA./referrer=http://www.xeroxscanners.com/en/uk/support/BundledPaperPort.asp/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CIK2i_DyuoGDdRACGN6aqavr5-GOOyIOMjQuMjU1LjE4OC4xMTgoATDP9OKhBQ..&tag=3660905

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.