home

slither_io.exe

Bika

SpeedySetup (Alpha Criteria Ltd.)

The application slither_io.exe, “Bika Setup ” by SpeedySetup (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.bundlessendquick.com and multiple other hosts.
Publisher:
Lalunu   (signed by SpeedySetup (Alpha Criteria Ltd.))

Product:
Bika

Description:
Bika Setup

MD5:
62c1240586fb6bb121a0e3fe89518f9f

SHA-1:
506712be64adf68b66f205dc144200c90da382b0

SHA-256:
a8fbb58f022a92a4889e96d6f4859f1273fa8a3a568fbada28cd13d54e5a073e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/28/2024 1:37:33 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.8.3.21

File size:
1013.7 KB (1,038,072 bytes)

Product version:
2.5

Copyright:
Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\slither_io.exe

Digital Signature
Signed by:
SpeedySetup (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 7:43:41 AM

Valid to:
8/20/2016 8:07:00 AM

Subject:
CN=SpeedySetup (Alpha Criteria Ltd.), O=SpeedySetup (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216B7B9B1E7ABF6047433BDBCDE9234400

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:M7iywLO1o3EIMDmUA1jzJjLTVGqlkINACvl7uo:MuGYwmxtjPVGqhNL3

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9279

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file slither_io.exe has been seen being distributed by the following 2 URLs.

http://www.bundlessendquick.com/tGda3Ey2DCUBDbsWjaaFmPROuUbqi6uEhPaaFuq1Z9Vj_Q27b7L7ZE1ICRwV69rGkYYNKykhTTxIGeqtOCn9diaKPMxV37sTrJptdbQu5GXfwHL4GB8NafLyrEf7SS0Bb7wuJRtiM HW1Fogn8LOyvBKANCAYJyYSB09zf5nrfCdy60Iieq4n45bS5e4FWF78M4NldOM5rhVFlfJrlZtFCqAdkNG_GVvXLG67wz1zqxNst8Nm9RmkoWsAkYhvpkXbUgpJWcVyZrw8LkguBTwjtBMLfFLDVJ mwH6bFqRattXq2raznjI83bfZjNtbdUX1jydrtlyTYO pnyxu6MKbqdqWcTv3MBcdRvcwFxyrZsm7BwpNwX5GFIqBFUUoE_mGCETAy_SU3fuULuadBuWh hfZrBxc_01CguFcS4OHLIVdI_8D6Pc_JeBlDhbmbcTyAc9bg6x62nEQJJaugBlEpy z3aPt LXb0N5QpwvEhLxoRTqOc3_47ou9ZervyxoUUC_ALxOVzZ84LDpSUeQMgRutySmsM0wAB6OoGe627T1hegpLvI=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.bundlessendquick.com/aPBr9ot6iNGRME4huPrIBONTARBPfGZFvV2PsN4DiDea8HbNVm3G PGASTHocH 6fMmyGpSRFqIh66_C3j1VjTrgiU CTyBhZPkSRo9cYPTzIlc6UiyJKPlaZuC0nBoqNUnXOKdSVOZwKvdSOnH28foxSVHgyfFDxun2AqscDIc2idc_WOxsvlrXcYulyZ9Th AYevEdMoiKdpEZhilKoOS595VMVNGfjCwcEbsVizWtBINnUuSQIUEuUCi4yrvglKn5_Ha94ZRSoaogSWXmfV09lorxHTdm a_HSe4qM6y4XbJr1qyS58cRNQG 8U8H6p PT1Z2XHg09y74aB9z PODblw76okMTgtzXMplvIMFEcpyDLqZo_mLRDRNVdT9uYI0Rq9mehLNUWeFvWT7uEz89_B_lEl755L5M0UgnWclJeQCxxzCUYSosU20gzeQE5Gq8H63g05dPJ1qq7lJjgNecPjZVRMXrG9kQHLjNZ5irLWVVMHuGmgBc MKm4qhdDNAz2Nx _Dm2JVDGCwjiEE7Cno5vnS9_mfeO9 DQgOkmVQRv6c=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

Remove slither_io.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.