home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 14 anti-malware scanners. The file has been seen being downloaded from fra1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
65a9bfa3198c692c5a3a2512f9301adc

SHA-1:
cc228701ae7d47d03eed50319896e54191750cb2

SHA-256:
ef0a0e5489f071598d19e4bdd4d02bfcc75cbf662cb9cbe2720adcdbb3c4532a

Scanner detections:
14 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
12/25/2024 4:47:01 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-141008

Dr.Web
Adware.Downware.5822
9.0.1.0281

Fortinet FortiGate
Riskware/Agent
10/8/2014

G Data
Win32.Trojan.Agent.4P134N
14.10.24

IKARUS anti.virus
Trojan.Win32.Agent
t3scan.1.6.1.0

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3132

McAfee
Artemis!17FD46A07B73
5600.6983

Panda Antivirus
Trj/Chgt.I
14.10.08.02

Qihoo 360 Security
Malware.Radar03.Gen
1.0.0.1015

Quick Heal
Downloader.Agent.r3 (Not a Virus)
10.14.14.00

Reason Heuristics
PUP.Installer.Stepitapp.F
14.10.8.14

Trend Micro House Call
TROJ_GEN.F47V0516
7.2.281

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
33712

File size:
407.1 KB (416,824 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\low\content.ie5\uyf6aw2d\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 4:00:00 PM

Valid to:
12/11/2014 3:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
9/29/2014 1:11:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:4ka9AFphibqI59Pk2cb7pUmJ0ftRdlxa8:4ka9ArhibqIjk2cvpUmJ0vdlxa8

Entry address:
0x6392E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1406

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
390.5 KB (399,872 bytes)

The file setup.exe has been seen being distributed by the following 25 URLs.

http://fra1.ib.adnxs.com/click?ctFvfuRlK0By0W9-5GUrQAAAAAAAADRActFvfuRlK0By0W9-5GUrQBL2PLWAJEMXngYWrYkaB3J9-TpUAAAAACQsIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAA8ckAAgQAAQIAAIwApSHihgAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.win-install.com/microsoft-word/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=fra1CJ6N2Oia0caDchACGJLs86mLkMmhFyINOTIuOTEuMjUwLjIwOSgBMP3y66EF&tag=2239524

http://ams1.ib.adnxs.com/click?TACZZ8oEwD8xCKwcWmS7PzEIrBxaZLs_S11eequCAkApVYDMTaYFQA8zksf6SnBuEMaipoc8pTRFMjpUAAAAAIHBMgBfAAAAdgIAAAIAAABx_SkBq0wHAAAAAQBVU0QAVVNEANgCWgDRSAAAwtIAAgUAAQIAAJQANCKFYQAAAAA./cnd=!HwY7OQiLsJUCEPH6pwkYq5kdIAA./referrer=http://www.driverupdate.net/lp/1/?aps=ad_vista_lp1&k=Windows Vista Drivers&partner=1015&utm_campaign=driverupdate&utm_source=1015&utm_medium=cpc&utm_term=vista&tid2=449455890&tid3=33058/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CJCMi7X6kM_SNBACGI_myLys35K4biIMMi4yMTguMjU0LjgwKAEwxeTooQU.&tag=3326337

http://nym1.ib.adnxs.com/click?FFbrXHn22T_qvk5Mzq3VPw4tsp3vp-o_6r5OTM6t1T8UVutcefbZP6zcdBIZO697dGjwI4hhFHPTEjpUAAAAAGncNwDIAQAAdgIAAAIAAABx_SkBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAA5scAAgUAAQIAAJYARCojxQAAAAA./cnd=!XQaTOwiGpdACEPH6pwkYn7YfIAA./referrer=http://www.amazon.com/?_encoding=UTF8&tag=hp2-desktop-us-20/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPTQwZ-CsZiKcxACGKy505OR487XeyIMNjkuNzcuMTkyLjQxKAEw06XooQU.&tag=3660905

http://nym1.ib.adnxs.com/click?66w97AhG0D_TmF-hWjnJPwAAAAAAAPA_05hfoVo5yT_rrD3sCEbQP0dj0tlXsfp0ix2BVMR4HCIryTlUAAAAAAoBNwByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAwbMAAgUAAQIAAJYA7CNPhQAAAAA./cnd=!6wVUNgiBtpQCEP6OqgkYkt4eIAA./referrer=http://ib.adnxs.com/tt?id=3604746&referrer=${REFERER_URL}&jq99wZYU=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIu7hKTFmJ6OIhACGMfGyc79qqz9dCIMOTcuODIuNzcuMjIyKAEwq5LnoQU.&tag=3604746

http://lax1.ib.adnxs.com/click?e2N-zavkuj-gVZZLs3S2PwAAAAAAAPA_oFWWS7N0tj97Y37Nq-S6Pzk3imRzAaVJphO04HufUAvvzjxUAAAAAGw6OADIAQAAdgIAAAIAAAB9_SkBn7cHAAAAAQBVU0QAVVNEACwB-gAxnQAA7L4AAgUAAQIAAJYAfyYnGwAAAAA./cnd=!QQcNRgjo4tECEP36pwkYn-8eIAA./referrer=www.youtube.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CKan0IW-76eoCxACGLnuqKS2rsDSSSIOMTA3LjIxOC4xMjIuMTIoATDvnfOhBQ..&tag=3684972

http://get.file2desktop.com/.../Get?p=2482&d=2705&l=2623&n=0&clickid=75873c5fb617f0ab33bcfd21&__tc=1404694728600&fileName=Setup

https://secure-ams.adnxs.com/click?zczMzMzM5D_NzMzMzMzkP3npJjEIrKw_zczMzMzM5D_NzMzMzMzkP9WgZDriA7U4gSxZfkkjkHFUVDNUAAAAAPf7LwB2AgAAdgIAAAIAAABx_SkBJPwGAAAAAQBVU0QAVVNEANgCWgAhcQAAYd4AAgQAAQIAAJQAWi5PwQAAAAA./cnd=!eAZLOgiEhMcCEPH6pwkYpPgbIAQ./referrer=http://webmail.tiscali.co.uk//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CIHZ5PKX6YjIcRACGNXBktOj_MDaOCIMOTIuMTguMTUuMTc1KAEw1KjNoQU.&tag=3144695

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJSx3qyyv6b9PxACGI_X0un2sOSTKCIMMjQuMTI1LjI0Ljc0KAEw1MDnoQU.&tag=3604746

http://nym1.ib.adnxs.com/click?StU-v2dGzD_mfp2aw-nFPwAAAAAAAPA_5n6dmsPpxT9K1T6_Z0bMP4-rNG2HkScolJiXJfuZ-j9U4DlUAAAAAAoBNwByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAAecAAgUAAQIAAJYAzSXNYQAAAAA./cnd=!6wVUNgiBtpQCEP6OqgkYkt4eIAA./referrer=http://ib.adnxs.com/tt?id=3604746&referrer=${REFERER_URL}&ZKHmyJHk=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJSx3qyyv6b9PxACGI_X0un2sOSTKCIMMjQuMTI1LjI0Ljc0KAEw1MDnoQU.&tag=3604746

http://flv2.dmrcdn.com/n/3.1.22.12/.../Setup.exe

http://flv2.dmrcdn.com/n/.../Setup.exe

http://ot.track.121oda.com/d/.../83c9955a-98e6-4262-b9cf-07ebff1b3f31

http://www.yupdownload.com/trace?offer_id=100038&aff_id=21813

http://get.file2desktop.com/.../Get?p=8723&d=12098&l=11517&n=1&productname=GoogleChrome&d1=103&d2=3266186&clickid=UAT_nym1CJSx3qyyv6b9PxACGNTnsIC83oykZCIMMjQuMTI1LjI0Ljc0KAEw1PyGnwU.

https://secure-nym.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA_AAAAAAAAAAAAAAAAAAAAANQzDMDzMkhklJiXJfuZ-j9UvuFTAAAAAIrWMQDIAQAA_AcAAAIAAAD7NwIBkwgHAAAAAQBVU0QAVVNEANgCWgCWKQAAP7QAAgUAAQIAAJQAYhbcYwAAAAA./cnd=!Wga9Pgjf4ooCEPvviAgYk5EcIAI./referrer=https://www.youtube.com/watch?v=1esUjGx2IbA/clickenc=http://get.file2desktop.com/.../Get?p=8723&d=12098&l=11517&n=1&productname=GoogleChrome&d1=103&d2=3266186&clickid=UAT_nym1CJSx3qyyv6b9PxACGNTnsIC83oykZCIMMjQuMTI1LjI0Ljc0KAEw1PyGnwU.

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMCf3JaxjLncFRACGPi3hcGd68WGNSIONzEuMTg4LjEwNS4yMjkoATCg6cGhBQ..&tag=3556066

https://secure-nym.adnxs.com/click?exSuR-F6hD9YObTIdr5_PwrXo3A9Cu8_WDm0yHa-fz97FK5H4XqEP_hbIdhZFw01wA_XEmPkuBWgdDBUAAAAAOJCNgByBwAAdgIAAAIAAABx_SkBEq8HAAAAAQBVU0QAVVNEANgCWgAPaQAA-uEAAgUAAQIAAJYAuyVfCwAAAAA./cnd=!RwaGOQiBtpQCEPH6pwkYkt4eIAA./referrer=secure.imp-serving.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMCf3JaxjLncFRACGPi3hcGd68WGNSIONzEuMTg4LjEwNS4yMjkoATCg6cGhBQ..&tag=3556066

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CLCxtc_lnJ2rdhACGLPLoOaYsKmmHiIMODYuMTQ5LjQ3LjkxKAEw3J31oQU.&tag=3144696

https://secure-ams.adnxs.com/click?o-8ugZmFoT-j7y6BmYWhP5qZmZmZmak_o-8ugZmFoT-j7y6BmYWhP7MlyIyBpUwesFjtWeZ0VnbcTj1UAAAAAPj7LwB2AgAAdgIAAAIAAAB9_SkBJPwGAAAAAQBVU0QAVVNEACwB-gAlcQAArrcAAgQAAQIAAJQA3SrY-AAAAAA./cnd=!1QaDPwjWg8cCEP36pwkYpPgbIAQ./referrer=http://www.shouldiremoveit.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CLCxtc_lnJ2rdhACGLPLoOaYsKmmHiIMODYuMTQ5LjQ3LjkxKAEw3J31oQU.&tag=3144696

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPaWqvGOqfeHJxACGMnp4cuhydb8JyIMNzEuNTUuNTcuMTMyKAEwk5TgoQU.&tag=3660905

http://nym1.ib.adnxs.com/click?i6ndz55-8T-e76fGSzftP57vp8ZLN-0_gs0C6bfCCUBhGeDI3dkOQMl0eBlKWvkndosq7kjdDycTCjhUAAAAAGncNwDIAQAAdgIAAAIAAAB-hyoBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAA1OYAAgUAAQIAAJYAfSkHwAAAAAA./cnd=!jQZiQAjd3M4CEP6OqgkYn7YfIAA./referrer=http://choice.microsoft.com/en-us/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPaWqvGOqfeHJxACGMnp4cuhydb8JyIMNzEuNTUuNTcuMTMyKAEwk5TgoQU.&tag=3660905

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPaWqvGOqfeHJxACGLfKs5S6pe2idCIMNzEuNTUuNTcuMTMyKAEw193foQU.&tag=3660905

http://nym1.ib.adnxs.com/click?i6ndz55-8T-e76fGSzftP57vp8ZLN-0_x-X5SV428j8w_JG0rM_1PzfljKIrtUV0dosq7kjdDyfX7jdUAAAAAGncNwDIAQAAdgIAAAIAAAB-hyoBH9sHAAAAAQBVU0QAVVNEANgCWgBWggAAv9AAAgUAAQIAAJYA-yyJ7wAAAAA./cnd=!jAZoQAjyxc8CEP6OqgkYn7YfIAA./referrer=http://lotsofabric.com/wp-login.php?redirect_to=http://lotsofabric.com/wp-admin/&reauth=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPaWqvGOqfeHJxACGLfKs5S6pe2idCIMNzEuNTUuNTcuMTMyKAEw193foQU.&tag=3660905

http://ttb.lpmxp2159.com/download/request/.../kw725cjO?__tc=1410310585.537&lpsl=5d11ba116b154ea0fadbc8d0693cf59f&expire=1410396980&PubID=269330&tgu_src_lp_domain=www.dllistsoft.com&ClickID=lax1CJjnsZ6KhfWqVRACGJX91_jBpMqLBiINNTAuMTQxLjY5LjEzMCgBMK3DvqAF&fileName=Setup

http://nym1.ib.adnxs.com/click?RBGYArGByD_7pgJiHP7CPwAAAAAAAPA_-6YCYhz-wj9EEZgCsYHIP-aitdB51JMihsRleN3ngDuHNz1UAAAAAB0BNwByBwAAdgIAAAIAAAB-hyoBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAH6YAAgUAAQIAAJYAWyPkRQAAAAA./cnd=!6wVUNgiBtpQCEP6OqgkYkt4eIAA./referrer=http://ib.adnxs.com/tt?id=3604765&referrer=${REFERER_URL}&7tzYgWOi=459_18x18_0/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIaJl8PX-7nAOxACGObF1oWdj_XJIiIMMjQuMy4xMjIuMTcyKAEwh-_0oQU.&tag=3604765

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.