home

slither_io.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application slither_io.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.appsworlddelivery.com and multiple other hosts.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
df41318ca71e53aac765e09734977034

SHA-1:
3073594bf54b09f31f5ad81f83188904746b9dc3

SHA-256:
47c4323a83ee589fae39cbd2651a85ff717b5a29e2bd82d744b10140cf936f06

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/28/2024 4:32:10 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.13.18

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\slither_io.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 7:14:15 AM

Valid to:
8/4/2016 9:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:bifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:OpZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9246

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file slither_io.exe has been seen being distributed by the following 2 URLs.

http://www.appsworlddelivery.com/VNahN765bnHCH4thbNoMnFgFO5zy1gvzqDCkvRI4TJbADMJHiEkhRWBEfJMbYFbhueoiVDLfOGKc0tWofUEvYwt8ve6KZsz2QELoyUPYKqMa68sH7LarUUnp84dKq7JGExMyv1fJf0yue_AKpHpmHY4hvoQVwl5veH2coS3pF juOemwzcbr_z6giPHIQlQndLoPf72gkwgji5lVkoccro0cYUxniAcA1quX7Hy9hyUss500LWrk_eiryukvrWAM5AEETUNLx_zIQws8hWV73_d9sYzVK1tTWNKvRwLQTBDxQ3YMkm bDzX26eRaD8Tdpz3OnjxJqSOTQ9iO2izaivxUbfao9CgzeEMAxY3l_ OG1rCPNPvbk nXvOvPhTGSj1XXQ1BGby8Dv48WPUq8A1cfTto1iScz6Cnfzw4tjHkvGwBSUVj5b28hBTyJCdKK0LTxWIRUyqinKxAULZ1jinJweOWCqPDKzM7LKwQkiVy9DjFzrW6LrV92noMpH7cYUpWV7Iqp-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/Tmu_QYUO47TSVltsYKQP8jSXpAzyi6HVsBqWMNyg2r96FGiZm6c9R2rr0ZGwkoR95En7mMsYB5KJ1E6WN7mN3RjaIUJ5oEeon9sSheUEGro36hiautoQgDlWHHNaQJFZaavFjMjpk 3t1 i6qqxe5Qg7spuwGG5mf_paH3qW4m6nyZzjaZpsZacePMbQLCJcVcb tqOTBLtekEkrQsYNblFZaghAwK6epbPbAgA mp mNTfQk2VqKX5CWTv59yCu VwEtIvHBAR1jgQvx4x fYakrdT3Y9NXnG09KGXMuNV7O3cJZN4eJzUls t52cogVEDRZdNuJ sSCzgo2u60JE4W0gVC4a3oopIZag 1nxBKd66bYk M8UwBg w251Wv7NLlM edJCYFPohY08J9yq16cIV1npflfG6t9A3QGjsPqy554uPaHi6G2JTDOocTr_T52hrrBOOc83VrWf3drQur 9J56QwKlhuV zzcbb79_y2nvMTqzS3peAe1W8rv9wQu0jv-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

Remove slither_io.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.