home

stremio_setup.exe

Lite

Quality Install (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application stremio_setup.exe, “Lite Setup ” by Quality Install (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Internet Web Software   (signed by Quality Install (Fried Cookie Ltd.))

Product:
Lite

Description:
Lite Setup

Version:
5.2.1.5

MD5:
332b568a234b1e97f704d89a55c26ee2

SHA-1:
bb310d2e14a7db300b44ac1e03a0a6b2fc65a917

SHA-256:
aef4647ffe10ab16c80898da365e4ab4c0c18ee499a80378a11a7d62110f93ec

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/16/2024 5:49:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.15.20

File size:
1.1 MB (1,115,824 bytes)

Product version:
1.3.9

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\stremio_setup.exe

Digital Signature
Signed by:
Quality Install (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:55:47 AM

Valid to:
6/22/2016 10:07:45 AM

Subject:
CN=Quality Install (Fried Cookie Ltd.), O=Quality Install (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11214C5CC912A574A2582BFB6F780F00F102

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:PPf8SfpPLjoSHysWVhBvDGP9hpwNJX/8D6bZ6XIKgawcMWvASFKsTI:PXnXOVjGP9DmX1bQXXi6vG

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8898

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file stremio_setup.exe has been seen being distributed by the following 8 URLs.

http://www.appsbinariesdownload.com/c?x=1Iwuk3VRUfw0ButIuon3C80GOzB Rgeo5N2/v0MmvaU=&c=InFOQfP4gYl/rnxge8ecWmx1vUqVbsHksGQdxvGk99fbc2 XW0G7U8x5uLIwlNt/3RGz0XuesmSg7rCMpEdyx2HnRnSvwHaxzyDVPxqItgbIWLr/S0LgeFdviMQgQxMo&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=P97X/nG4hknceJoeYJVbO93AZNg6ldYSB54D4B3 /Ks=&c=AFy5R jJsCfVfjMBgJBp5V74bSd4GK 7rborZnuefC6g/OPM4n PnJesv/3W6ouDNkud691N1l2qAelUxdpGGKPXbD42FrDwGXI6PPhFn2uEcktUfXG9dCKiXV4JuspQ&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=9iymjkRj g/Kj7NuQojHDtihNMuoOvSekGs6FDoToU8=&c=IZjkYrxiZWL6UhxtqmMT0Gkjf6vOBlpZpyRevFzil4aBfhh60uBIEWliCg7suSlsvzTFSq2qugwkbSmwV4wpeJVo6tCRtByNCK2FxN2pLygSpCXBaO1sEqSsAANujpX5&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=TyJIPoLGchbU/c/PHDWxdonrMPJMXRpsa0ck7LD4aTc=&c=h01IxhSjAsyzHDUyIXpzZBDCXnpx5IgfB3PxaPw46pyHXyVd2RcPLV7GUpAvVzzVyywTWfvk9tE/an/Tm tkIt7/Sp4c2CGvUNXiah4Wi JAkJofDCvCYKphfMiEpYZw&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=wU6p5F17YfJZsmSnlPXHbEdgLDGGdE5mwmThOnGOBQs=&c=Ngj6 y5jloskvMKvqEFyKWTRRi6LcviWXhzSuBV6HML04HFO7FDDiQ 6QUs6YrhEA/DybIcH/rFMQGKW GQJvSN2TtqV0NsKJ9j5cojEFZ7IlGU5jpu03HQ6v7m 29cH&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=gEFuIf2G6rFyWoOrd3A19kPkVQAz8I9swkm7t6g9SCg=&c=VLhJT xV8SUwv58CLPiJjxq7i6F6tBIjEtmeYT39fVDfPCmqfec/s/M7RmBMI5x1cnjdpGcpTLXaFqQPGgn2YXo2rxBrM3tWvndTAyRO0RjC6x6x2MSNyD6aQF0QGpR8&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=eM6HjsOULuugpn8KXMRX1ffZLRK6c1VzrDOIrjopxVg=&c=4F10Udp5grOwdeL8Y/cQ8yBQRJTpxfx2dPBAi4rh5l3zAOkd0e7qpMx/TXnmZWyCSolh5ztSTTYtBfhAPA1VQqFbTNfoMwnM1d68yTICRLMZ4wjvlqB98wbQkbi2pMoG&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

http://www.appsbinariesdownload.com/c?x=9xvegeiPXZhfPqN /qxTxgdo6p1iEKfo2AcsoyfcMJI=&c=pzeLQtIsc4pqYM17eewlOypWjMsJSabYVgYjyhrlreaW4oTNmoiCp B6h2t04o/GC7VSIdTq2And8 MNXC4U0K/289d7jD/mtBz5yPyLQuYJEbNPqNq3AfYN/lejeWQQ&downloadAs=Stremio_Setup.exe&fallback_url=http://.../Stremio 3.5.7.exe

Remove stremio_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.