home

setup.exe

Bechiro S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application setup.exe by Bechiro S.L has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from flv.softpzivrubajjui.net and multiple other hosts. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.
Publisher:
App.install  (signed by Bechiro S.L.)

Description:
setup.manager

Version:
3.1.12.5

MD5:
b97795d13f852a5548aa4f3b2cbb3da9

SHA-1:
ded4c2426425c884106cf2d57004d29dbc590476

SHA-256:
d5289e42a97f883176c8eea4a48d6b38938ca2f5eca373dbd436a8e0b138a499

Scanner detections:
33 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/27/2024 9:58:39 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.M
668

Agnitum Outpost
Trojan.MulDrop
7.1.1

AhnLab V3 Security
PUP/Win32.FirseriaInstaller
2015.04.08

Avira AntiVirus
PUA/FirseriaI.A
3.6.1.96

avast!
Win32:Solimba-C [PUP]
2014.9-150710

AVG
Adware BundleApp.EA
2014.0.4311

Bitdefender
Application.Bundler.M
1.0.20.485

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Trojan.Application-478
0.98/21511

Comodo Security
Application.Win32.Firseria.K
18468

Dr.Web
Trojan.MulDrop5.32888
9.0.1.097

Emsisoft Anti-Malware
Dropped:Application.Bundler.Firseria
9.0.0.4799

ESET NOD32
Win32/FirseriaInstaller.I potentially unwanted application
7.0.302.0

F-Prot
W32/A-c99c506c
v6.4.7.1.166

F-Secure
Application.Bundler.M
11.2015-07-04_3

G Data
Dropped:Application.Bundler.Firseria
15.4.25

herdProtect (fuzzy)
variant of file_installer.exe (Adware)
2015.7.10.22

IKARUS anti.virus
PUA.Morstar
t3scan.1.8.9.0

K7 AntiVirus
Unwanted-Program
13.1712333

Kaspersky
not-a-virus:AdWare.Win32.Fiseria
15.0.0.543

Malwarebytes
PUP.Optional.AppsInstaller
v2015.04.07.04

MicroWorld eScan
Application.Bundler.M
16.0.0.291

NANO AntiVirus
Riskware.Win32.Fiseria.dakwhg
0.30.10.952

Norman
Dropped:Application.Bundler.Firseria.D
03.12.2014 13:20:04

nProtect
Trojan-Clicker/W32.Fiseria.509424.B
15.04.07.01

Panda Antivirus
Adware/Firseria
15.04.07.04

Quick Heal
PUA.Fiseria.DC5
4.15.14.00

Reason Heuristics
PUP.Bundler.Solimba
15.4.7.12

Rising Antivirus
PE:Malware.FirseriaInstaller!6.19E3
23.00.65.15405

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.26.3

VIPRE Antivirus
Threat.4782980
38882

Zillya! Antivirus
Adware.Fiseria.Win32.1
2.0.0.2129

File size:
497.5 KB (509,424 bytes)

Product version:
3.1.15

Copyright:
copyright © 2014

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Bechiro S.L.

Authority:
Thawte, Inc.

Valid from:
6/12/2012 7:00:00 PM

Valid to:
6/13/2014 6:59:59 PM

Subject:
CN=Bechiro S.L., OU=Devel, O=Bechiro S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
738DCAC697C06E1B89D106073773010D

File PE Metadata
Compilation timestamp:
6/3/2014 5:18:13 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:1YYZr6ypt7xGspjYu+Uhx63UXBQddduJDOxe0:1Ycr6y/xxsg9BND0e0

Entry address:
0xE05C

Entry point:
E8, 7A, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 38, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, F8, E0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Code size:
113.5 KB (116,224 bytes)

The file setup.exe has been seen being distributed by the following 3 URLs.

http://flv.softpzivrubajjui.net/n/3.1.12.5/.../Setup.exe

http://flv.softpzivrubajjui.net/n/.../Setup.exe

http://2.track342ut.com/d/.../NzI0fDM1NTd8UEV8M3wxfHw|68f669b839fae1b4f237c2ab7826140a|d7a04500-ede7-11e3-a1d2-002590f00f96

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/59895327/launch

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.