home

systemmonitoriisetup.exe

Turegoleh

Opti-Connector (New Media Holdings Ltd)

The application systemmonitoriisetup.exe, “Turegoleh Setup ” by Opti-Connector (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from vlr.tynt.com and multiple other hosts.
Publisher:
Opti-Connector (New Media Holdings Ltd)  (signed and verified)

Product:
Turegoleh

Description:
Turegoleh Setup

Version:
5.6.4.1

MD5:
e2d46b2a3c9b0b1d4e726ef7b4687646

SHA-1:
f8c42d42f6993a0d776a8a4f6ab44c58e57caad1

SHA-256:
e0b058ab6050da464811673c3a3d8a881221bfcea8ec06e36bd2dea002a8f4b7

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/27/2024 6:50:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.9.20

File size:
963.5 KB (986,592 bytes)

Product version:
4.2

Copyright:
Stub File

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\systemmonitoriisetup.exe

Digital Signature
Signed by:
Opti-Connector (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 12:17:28 AM

Valid to:
6/25/2017 7:58:45 PM

Subject:
CN=Opti-Connector (New Media Holdings Ltd), O=Opti-Connector (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121514827CB46F6E7CA11FEEC66DEF15479

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9g6elNYTQcSOcwFp+/c1Xm/3FLJXKHU1xjuhwUS:9BQNL0FJRm/3Fd6H6VUwU

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9320

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file systemmonitoriisetup.exe has been seen being distributed by the following 7 URLs.

http://vlr.tynt.com/?format=txt&key=284d869ffe43382ebe88a02cabb697ab&u=http://www.cleaninstallersbase.com/q2ii9v_XNt_MCARAbrBOQVb9ioe9tW6JkZiXAU1BNfnW7qpBhB sjpU0FmNLtfXb1a0ySOqPTIra6qKDzm3 QQLODrpjzzBsTBgt6HuTte4H7wBPcIhhukH9ulYpMAX5FfKghPW1eLrT2CAkPbPC6KXqE92UYYBritF2qZMIRHzs82y9yTEHvGnerFu4Av7n8Mr3nNvaLa 0WpocJ7PL _U9zzHM7J4cFIDKBizWV piNfSsTU6M06iqOgCFrnYkmGIHm49BmkE4tEvyNT7gKzfKIHtSPHGJcYArOPm1sbOB v5W5JtqJCiUZPGkuoxXubOfDw zaHvMzNkVDVAxqi0zYHZ lg1Vwp3nev_lV0fhQq8o5pc=-GzAAAERveH7beStZDpRHwCEH7N8OGiRY4CEr6e1M4xojP_W8Mk_6kB3Dq8vydlpoBQ==&subId=w!buriv8k3gg15&txt= &loc=http://www.myfavoritegadgets.info/monitors/SystemMonitorII/update.html&ref=http://www.baixaki.com.br/.../system-monitor-ii.htm&title=System Monitor II update

http://www.cleaninstallersbase.com/aRLNiZgXOtRGowJiF5POjavdy3UV9vX9fC2jdA64Z_jLgdOkC1tcZFx6am2N3OrOBlLVsU3OLrnpZWxmzDqOYVB7gmCnVpwAPTht7CnNKM8fR EIrr1KzaTCDLSO42wtROLyrtv19EYEO4yCTmHkIzG2Z7hulDctOkfg5WoZXmbCez4jPM2CpxtavBqf_luATj4106VGyekvqSKL3e UBEuh61q2HYiNwd_8SObF4G yra_4VW72bORmzkO5uDYpdl4WZ ce0TOExnHbDDui5a3QZ13_IPG5sZ1mKLVOyV6NyDexzwL8kGm7elqrxrgxBzQQIC2q8DHt7rdlgP7BFw5ty70ocKddWnR2gIVfS_UHctnoSsU=-GzAAAERveH7beStZDpRHwCEH7N8OGiRY4CEr6e1M4xojP_W8Mk_6kB3Dq8vydlpoBQ==

http://www.cleaninstallersbase.com/WVl6OTRQV2RZY0RkNlowY3pVSFpqY1dscVVFdDVUME4yYjJSdk4zRlFUak00TTBWNFVVcEpkMEUyVEVsVE5HY2xNMFFtWXoxYVNUZGtSeVV5UWpsRlkzb2xNa1p1UW10RFVHZGlReVV5UmxOR2NFZ3pXREJ0TmtKSUpUSkdiakl3VkdGWE4yOVJPRlpuUW1kSlFsTndNek5QVVRFNWRHWnRaR1ZQZEdzM1VuaElaRzAyUkU1amIxTjZWRGhGU2tKSk0wcDNOVWRrZWpKVVExaDBPVTl3ZEdzelNISnRla1pEZEZWRFRIcElUa2h3Y1RKNFJXSjVORmM0TVRkc0ptUnZkMjVzYjJGa1FYTTlVM2x6ZEdWdFRXOXVhWFJ2Y2tsSlUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbTE1Wm1GMmIzSnBkR1ZuWVdSblpYUnpMbWx1Wm04bE1rWmtZWFJoSlRKR2QzSnZibWN1YUhSdGJBPT0=

http://vlr.tynt.com/?format=txt&key=284d869ffe43382ebe88a02cabb697ab&u=http://www.cleaninstallersbase.com/0CDcnSmb3STtkDOa5mPfbmqYP6bw8gIsWz6zdjr0uMwLrhSEMXqNBDW4RKYcsCZoRE8P_8pd2zO3YGElzKaHI45uVJTeyzDnBJh8HmN2MN s0f8TjOhOmEctIYCfGj5zVMDIpXyv43IPt_6kipAPAmJcwpbn1PdLBkmVX0wGuC 1tK8zt_uI2FGUyFkdO7hSn1wkxMtKOes MGBPkblPDA8_C418DLvW7ZoUIAa9SS573ynGWb3SaTvJveF4E43r83GXjz_0 J UVcBSFzsNMBomqnHDW85ovOxa6tKMEsBNUCK f7aNRh7gVoRPEzkWCi__lkK7T2WN9JDPl4NVDSImM_lZgT9Vl rPDOf2Kge0j6Vvj A=-GzAAAERveH7beStZDpRHwCEH7N8OGiRY4CEr6e1M4xojP_W8Mk_6kB3Dq8vydlpoBQ==&subId=w!buriv8k3gg15&txt= &loc=http://www.myfavoritegadgets.info/monitors/.../update.html&ref=&title=mise à jour de System Monitor II

http://www.cleaninstallersbase.com/WVl6OTRQVTVTT0cxa1NpVXlRbmhXWWxsVVFWbGlVemt4VUhodllsZGhPV05uV1hOM2MyeFBSekZ3TnpCb2FpVXlSak5SSlRORUptTTljamxtTkVkemQzTlZSVk13SlRKQ1VYTnFUVVZVYUdkd01qQTNjblZOT0VKMFdFcDZTV1o2U1Uxa2JIRlRXbklsTWtKMWJDVXlSbUUwVDI0eFNIVkJTa3RhWnlVeVJtbHljbWxYZEZCNGNrTlVhVWRrWkdRMU5UazJTRlZYV1ZKMkpUSkNhM0UzTm1wck5YYzViek1sTWtJMGVFUmlVV2RvUlZCR1ZIZDZURzAwUlUxR1dGVjRSR3hJVlU4bVpHOTNibXh2WVdSQmN6MVRlWE4wWlcxTmIyNXBkRzl5U1VsVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3ViWGxtWVhadmNtbDBaV2RoWkdkbGRITXVhVzVtYnlVeVJtUmhkR0VsTWtaM2NtOXVaeTVvZEcxcw==

http://www.cleaninstallersbase.com/WVl6OTRQWGxTY1U1SWNteHFVbTltTVU5R1EzWm9jR2g2YWxOWU0wOU1WbXRMZGxGUFVWSlJVM2NsTWtJbE1rSk9WelEwSlRORUptTTlka1UzYzBrNFVDVXlSbkZaZEZoTlVXOXRUMHBMWVVzd2REaG1NbWhITldGRlRrUTNOWGhHYW0xU1JsaG9ZbVp3U0RKdk1YSkJObWd5UVdGNFJYWTVTbVYxU1dKNFQzWnZlVFZIYmxwUVIxRjZSbXBCYTNCbVdFbEhiSE53YjFWcFIwcEhjbTF6WjJoTlpYUjBha3BCYUd4RFdVcFlaVXB1TlZScGNHWndhemx0Vnlaa2IzZHViRzloWkVGelBWTjVjM1JsYlUxdmJtbDBiM0pKU1ZObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NXRlV1poZG05eWFYUmxaMkZrWjJWMGN5NXBibVp2SlRKR1pHRjBZU1V5Um5keWIyNW5MbWgwYld3PQ==

http://www.cleaninstallersbase.com/WVl6OTRQVmhPYWtoU2JVWnlXbUY2U0VOa1lqTXhTMk5zWkRZeVZrTlpaV2x2ZWtWb05tRlpWMXBJV21sRlFrRWxNMFFtWXoxalZGTjVNamQxUW0xVVdVZFhjVFk1WmtKR1FXWkpUVkZZUVZCU2FHMGxNa1pDWTFOMmVERkNielJvTVU1d01sUlBZVVV3UldkSE1IcFdaQ1V5UWxOaWJta2xNa1paVkVFMWRHVjVkelpLSlRKR1QyRndhRzgzV0hKVWJqTWxNa0pOTkVSSFpXOGxNa1pUV0RaWlFUbEVUakJRTkVwaVJ6Sm1SV042UkVnNWFuWllKVEpDUlRoNllsWjVkelpTSm1SdmQyNXNiMkZrUVhNOVUzbHpkR1Z0VFc5dWFYUnZja2xKVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtMTVabUYyYjNKcGRHVm5ZV1JuWlhSekxtbHVabThsTWtaa1lYUmhKVEpHZDNKdmJtY3VhSFJ0YkE9PQ==

Remove systemmonitoriisetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.