home

slither_io.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application slither_io.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsworlddelivery.com and multiple other hosts.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
ab1c7f5fe9ded02ff2d7d93d285fb45a

SHA-1:
ca18ab31a18ccc604029fdf4df3dcdf452b981b2

SHA-256:
2096da8bc557deaca28271795ff1ac4397ec0da8f6eb52d92741cf1fd60bf90e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/28/2024 4:24:29 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.13.18

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\slither_io.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 5:14:15 AM

Valid to:
8/4/2016 7:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:oifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:lpZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9246

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file slither_io.exe has been seen being distributed by the following 4 URLs.

http://www.appsworlddelivery.com/kWWcK4__aoZ8n1RJTDvVt_OKMGhkbxSDoHWOy4ndR9DsHiEOHFR_9n52MzOPIIXagVcaFNXttPluwMHqImJlI fW9nGYSofPIj obWS_UvdSUd3gcPF3f f8zX_SHR7X9N4uqlsy5YgVpuNC3qyqkOy9OeA4Tv8vqXTqLx wKn6K9e7Q5j Q1HmBICxyVi985ud1HIRldLT2ajXMCfrhHP1l9jfxvd364A2LH0d1dr1bN0P8Rk_sdI8j6My1k9atUeSBQ7QypxeRhXKjINawl2p8utsaWjqSjThNWBXddu_khTx2s4hVjeIHQphOPzliOIyguMfKNafOmiblYtotjlU6Y3SUal35uQ49HFqYWmz10P3Yh0rV_iZ6w3CY3WIVfrJEwYUVV_muQRYggbJVVpI0zPxqlN3VDFQXWdYWymQAqjrgARV08xe2bIhJTlg7JdhJV0p3eJzuGvYuHMm1ws2NyWYkovEQKVy_HioiBa awPckKjmVOB1Am81bov8KnhbIWc1XjbZ0efpdTLMyOuD5yXv5e0LBsnvS8G3ZLhNrjBWE7wk=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/T5pIQdfdvWIYC3pt5JVdD4qbmkYfasB527dL8Ei9hSFlxezZpsfNf5LuowLLcRqMlNbcIjiLMz6yp1cWr21yC9tlIIZfgKzvCZ 3rrVlHMkySZmpUd9zmCUN8xkbleT0N40j61qdXBDHgbh9yG7JDzX_7XwuBBvObn0NvAKsDlVOrKcwAi1HpnhdU_lX5oNB_ jRT PbJg_JbgATeKH3f_4wEuJNiCTJb95tcnO1e1I1EuvEnhWVChZdwSX_zfY_fnjjdFRPG1IMTi5XFWZtaUYfdBfeCZ0D08CT9vKdS3yxnv_CM4iG8rBSO yldBRxdrF7FpHj56fSQ 5BbTmlkC kmIrHJ2josmM3phg6_pZASESMa82f_hQuQeKPnZjQMcQRV7tLsO29NmzxylYKdiU3bJ19rCfKWRwBcYs2tJj0 4O1SR6rFxYTEo7pJPdtzsTkcNRNAVsn9 TFrKKZBDdWbKoz oQOQRegTn2yQEQ3_R hxkiNlmHEvQU_ufqk4Y9mrJb_trRHSp3B9TC0aAuc0klT3O8yDPtGa6FWMSmcegH6E24=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/uRV7R2bnr5Z5zU1EiuHjUD1U2TuDt64IJkvyrwZaC6duHd0r9u21yuME Ody0MGP_tO0giwspAw3uqJ6Yxuklvy7zkUrsmnIdFCv awxdxGgO4MxOc29kRacSnO mejMlgvrCPu2Ou1I qJAzQ7ykaH1ZozGfGv3w9exnENnyouekpdmpe_yEHbSBrsqiZR_s_hdptp3Hqf7whAouXxTYypDr9lntO9ol5dfty4u6L9Tqdk51PSZPIqTU5gpB16gZvEDCEtme aKtItQGgBAKb474kCcWEJDHDXhVw3TNq8y6CqhmMdaLwAY6xepx33GjOutDfdKZ9cPfOHobNdUT578SuHc0XWadfTgYd_dN4VL7vH32vdeK7R2sJoMcF92U0LMTmBJ3PnWdqRY0MnQNHdtxOQaSiATBtL80viGN6K2NohwBnNz5fN5Ff 7 kQiJj_tDki0cVEbXQdJoQTEGMSxG1y39k2Y eQN8W5MQjyLrmX55kKaRZ 0QES0jYHRuFCXdnP9m4NlMfTakGfEoY67Lb 8bdUuZtuMqxXk31GnHXLebd8=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

http://www.appsworlddelivery.com/PpPP8w19njMRP080oqieVd2kN0ydhHS1_Ha x0pWjBrv48HG81JnbFyVJTuBxnE3LldOBJkENJL28Rk8kiz8c_BI3T0BG7LMbdP67werLhZcVvTip_DfOxOL5x7MgeuKp6 BZTvi6CfUDz36WbmnuWaDUIKoXhItasteJ0eE75PMSy4WflEJ0MBvRAsFU Az6KUqODdQZNnyCh I6fP3FjvK1LIypRT bea_wI6JmsSO8Oxz_jdoLXf1tDpuqjDZknwqeowNcpaWJPGeinPIJd0br0E 3ev3HOi5LPcC3o5j9RYkz4zH9KA6rjaxi8leUBukA1zbPI8lIo35fpAExflT75Z3D9_3ItJEHfETX7siIU2jutjzgLSrgE4LZL5TWGymxBUBTYamoBXY_qlPLhM1b_HMRKvdL5M8CSrDGWEzBQ6PbsGY4MRlZlnAeeZ6cnrfMZZlvrcck5p5pRY4wGaUGgOWPgfBkombph90x6fZqMK6stL5mgolMbRjTtwv4AhPtZKEPgIqlsYhy3HBA6G9rxRLRj9YH2LyejwJQetsM0Fgn8E=-Gy4AAERveH48O9_JSikcwCEHfED9VhKw1djmgXJjAypsEGLxO863dMlRG58=

Remove slither_io.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.