home

slither_io.exe

Fepem

Quality Install (Alpha Criteria Ltd.)

The application slither_io.exe, “Fepem Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.bundlessendquick.com and multiple other hosts.
Publisher:
Gotelodin   (signed by Quality Install (Alpha Criteria Ltd.))

Product:
Fepem

Description:
Fepem Setup

Version:
4.8.4.5

MD5:
11225015a6036b1cec6d184a2092806d

SHA-1:
75dab9c2ea24d0a59bfebe918303f10cd9698394

SHA-256:
64c9a42aa299b08a4d03aedc8304b9202d3ff73d3793e589ad46341777251e2a

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/28/2024 4:44:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.14.11

File size:
1020.1 KB (1,044,544 bytes)

Product version:
2.1.8

Copyright:
Installer Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\slither_io.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 7:14:15 AM

Valid to:
8/4/2016 9:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:BziQLeq31X/1IiwGlNX6fWD8r+Fk6xcJ4MkdvuICc:BWDEhaZiNX6O8+FnxbdvuIn

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9253

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file slither_io.exe has been seen being distributed by the following 7 URLs.

http://www.bundlessendquick.com/gb0VWvcjJIomwFjIJuizaCsIRRQXFAyiodODw71HP4QgnBWWXYiLfpbjOfQWJcjjXMn9zdTvkj1Cql4RsEyzPvx2BQa_bnAsh1VJW29X5SByu AdAPGSoSoJwQ yQ4dHZbd3AniadzUuv5x7HPcukpDlcGbWfb9KnYyu7euNp1Vzfs7Icd5KKKYlT2Z036PCtnLfaVdn-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.bundlessendquick.com/GCNN9U0PXFloUYsYhgX4PlzQhGSsmBX397m5KlXuOU8EaQBiI86DN6uxtl3OC3cbG _asMZG50JLLixxx0MME9IC6cSuELWpJG8U_ZKsy gnxVepyibpwXq6c54URxEfYL9JPqAbGhVAjLFem7po_y5gKrFRcjqvMRJ3GbzA3oqyA ODZ8zd67gNvnNXJNVXlqsU RAy-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.bundlessendquick.com/FFRnu_Wl PiK5sI5rN8YMWxar0oN2Xp4VktgLRrVWz N3Lw8QpM1R_HEUg 3fOBXMu5Maj2VxpxBHKiTMD23Tej8qSMkV1tqWcgh_omwcGDYOrLsn2sdkk9hfduO1gCyn7r OV_78hqW9N1sjD314g6PcXh8HWzhvG1HbID8PxeHnBGiEMcm6VnMK_geF7W Y1UB_XNK-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/L8uPu3_TPrAUsiDMPlnLPIa6M4pmAgAN4zT5nYuoPqm3EwZvIUHd4JWzyaMTpYX8r9lAKtkTXbMwmbi09JpOD2Bv 37DoVYhUV8aK4C_Ao187swdGrgBroYqWoQ0LXO2aZ9Qy5HmDilYicdlSlHHqFsZ PZccKBOutRWqLZFaisfcwGhxhyD3jZWHfRLgilxRw_FfzYP-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.bundlessendquick.com/1qE3gXXMDfmKfl5yJMaQczfW4vY4cL8bZcexYZv3PdeNgMuYZml_6RELPUrxsH9nKJYgUOfwVydpr9_ZTgqTVzIYN1JH8EmRgEoMvuoth4pwY_HgBelJHVCu8efcINMkce1XGqA62ANv67g9DS RhjRB4j2V51GQQ78BgTn3RDk6rhiYMe36jvsWIxjcU15UIxKszWDy-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.bundlessendquick.com/f8Al1_Wn3_dS6BvPbCADGqKtRpRLH6e97PdqoUvdFmSVEyvpMx1rBdfGGZoKlOiA3GdxqgNpXLVE1_7PfB6kpdP401i_GPvx_HB1r9ZSE8zoWNDqE 1wzRUOAX9g7WC1ps4I2xp4bxOn5XlDmRsJm5lOEr0skcObkI_mf3fTMTkqQlTVMgxdllH2pSImviY2Pnjwj8Ff-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/OXcCtAKJTapv w3g_HjGQIPYcc_umpzUE4N8Gy9aDPc70NL0fOTXz9SUbFfvOVBg4xrlLqkkiixR7EXwQckebUxlor_PtaQsE5yt00tGBP3sdExmVSRK2_R1MSgor0X8CARSfMNzPrW56BoRW4FIWs QW MIL80h7Bmd1uY391vPY03lQqOdVBJQtxYzv3gzMZlRKRBJ-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

Remove slither_io.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.