OneBrowser
Ebausaldusväärsed rakendused, mis manipuleerivad brauseri seadeid ilma nõusolekuta, kujutavad endast märkimisväärset ohtu kasutajate võrguturvalisusele ja privaatsusele. Need programmid, mis on liigitatud potentsiaalselt soovimatuteks programmideks (PUP), võivad muuta brauseri toimimist, suunata liiklust küsitavatele saitidele ja jälgida andmete kogumiseks sirvimistegevusi. Üks selline pealetükkiv brauserikaaperdaja on OneBrowser, mis segab kasutajate eelistusi ja propageerib kahtlaseid otsingumootoreid. Turvalise sirvimiskogemuse säilitamiseks on oluline mõista, kuidas see toimib ja levib.
Sisukord
Mis on OneBrowser?
OneBrowser on pealetükkiv rakendus, mis muudab brauseri sätteid, et sundida kasutajaid kasutama ebausaldusväärseid otsingumootoreid. Selle asemel, et pakkuda asjakohaseid ja usaldusväärseid otsingutulemusi, võivad need mootorid eelistada sponsoreeritud sisu, eksitavaid reklaame või isegi suunata kasutajad riskantsetele veebisaitidele. OneBrowseri kehtestatud muudatused hõlmavad sageli vaikeavalehe, otsinguteenuse pakkuja ja uue vahelehe sätete muudatusi.
Pärast installimist võib see brauserikaaperdaja sisestada veebilehtedele liigseid reklaame, põhjustada sagedasi ümbersuunamisi ja manipuleerida otsingupäringutega, et saada kasu kolmandatest osapooltest. Kasutajad kogevad sageli aeglast sirvimist, soovimatuid hüpikaknaid ja raskusi brauseri seadete taastamisega.
Kuidas OneBrowser mõjutab sirvimiskogemust
OneBrowseri olemasolu süsteemis toob kaasa mitmeid ebamugavusi ja turvaprobleeme. Kasutajad võivad kohata:
- Sunnitud ümbersuunamised : otsingupäringud ja veebisaitide külastused võidakse suunata kahtlastesse otsingumootoritesse või sidusettevõtete lehtedele, mis teenivad OneBrowseri taga olevatele operaatoritele tulu.
- Pealetükkivad reklaamid : hüpikaknad, bännerid ja tekstisisesed reklaamid võivad ilmuda sageli, mis toob kaasa küsitavaid pakkumisi, petlikke lehti või isegi võltsreklaame.
- Andmete jälgimise riskid : brauseri kaaperdaja võib jälgida sirvimisharjumusi, otsinguajalugu ja isikuandmeid. Kogutud andmeid saab kasutada suunatud reklaami tegemiseks või isegi müüa kolmandatele isikutele.
- Raske käsitsi eemaldamine : kasutajad, kes üritavad brauseri seadeid käsitsi taastada, võivad avastada, et OneBrowser jääb püsima, ennistades mõnikord end isegi pärast desinstallimiskatseid.
PUPide küsitav levitamistaktika
PUP-id, nagu OneBrowser, ei tugine sageli otsestele kasutajate allalaadimistele, vaid levivad eksitavate levitamistaktikate kaudu, muutes nende tuvastamise enne installimist keeruliseks. Levinud meetodid hõlmavad järgmist:
- Tarkvara komplekteerimine: OneBrowser võib olla peidetud kolmandate osapoolte veebisaitide tasuta rakenduste installijate sees. Kasutajad, kes kiirustavad installiprotsesse ilma valikuid üle vaatamata, võivad selle teadmatult oma süsteemidesse lubada.
- Võltstarkvara värskendused: petturlikud värskendusviibad, mis väidavad, et pakuvad brauserite, meediumipleierite või muu tarkvara jaoks vajalikke plaastreid, võivad selle asemel salaja installida OneBrowser.
- Petturlikud reklaamid: tasuta teenuseid, kingitusi või toimivuse parandamist lubavatel petlikel reklaamidel klõpsamine võib viia pealetükkiva tarkvara tahtmatu allalaadimiseni.
- Ohustatud veebisaidid: teatud ebausaldusväärsete saitide külastamine võib käivitada automaatsed skriptid, mis proovivad installida soovimatuid brauseri laiendusi või muuta brauseri seadeid.
Brauserikaaperdajate vastase kaitse tugevdamine
Et minimeerida PUP-i, nagu OneBrowser, kokkupuudet, peaksid kasutajad võtma ennetavaid turvameetmeid, sealhulgas:
- Tarkvara hoolikas installimine : komplekteeritud pakkumiste tuvastamiseks ja tagasilükkamiseks valige tarkvara installimise ajal alati sätted Kohandatud või Täpsemalt.
- Kahtlaste reklaamide ja linkide vältimine : vältige hüpikakendel või tundmatutest allikatest pärit reklaamisisul klõpsamist, kuna need võivad viia petliku allalaadimiseni.
- Tarkvara värskendamine : veenduge, et brausereid ja olulist tarkvara värskendataks ainult ametlikest allikatest, et vältida kokkupuudet võltsitud värskenduspettustega.
- Usaldusväärsete turbetööriistade kasutamine : reaalajas kaitsega turvatarkvara võib aidata tuvastada ja vältida volitamata brauseri muudatusi.
- Laienduste ja seadete regulaarne ülevaatamine : kontrollige regulaarselt installitud brauseri laiendusi ja lähtestage brauseri seaded, kui tuvastatakse volitamata muudatused.
Olles valvas ja rakendades neid turbepraktikaid, saavad kasutajad end paremini kaitsta pealetükkivate brauserikaaperdajate eest ja säilitada kontrolli oma sirvimiskogemuse üle.
Analüüsiaruanne
Üldine informatsioon
| Family Name: | OneBrowser |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e810fdd67f792f51677eb41147031d1e
SHA1:
64eaeeb21a0a88ecde826f57305af566909e8c97
SHA256:
6E1F84E3B1A1681C7FD2E643130433DBA9E12D442A433B0FC714E9FFC84D7FD0
Faili suurus:
6.77 MB, 6766600 bytes
|
|
MD5:
04871138a46b1e55c4898530c95be835
SHA1:
cde11f7d08536e148b8c70182cb66a389200f9d8
SHA256:
DF1B14CCD5D08C61E8BB2327D1AF264E09D7274C49F21D84E6141209875ACF71
Faili suurus:
15.37 KB, 15368 bytes
|
|
MD5:
952071dcb852425349ad191050699518
SHA1:
b5825f3a889b9e1b0cf380230158ca16f62184c1
SHA256:
0055AE7323E8FBC5FAD5FC3E651929DEBF6EBB82D2CF3C885C71ED03E4E8A336
Faili suurus:
4.25 MB, 4251144 bytes
|
|
MD5:
0eb3d14380dd71d54dff49a641b48036
SHA1:
7f06413aa0b71f815e49f63944d84cf7e0c926a8
SHA256:
1A2E843630CE3CF0AB4FCEC4D4A259FEFD792EF2C0BB108A1E658B23CA5F781A
Faili suurus:
4.07 MB, 4070408 bytes
|
|
MD5:
c5f5c43c21d5e96466bc89f636369faa
SHA1:
76ff31a1625519f9cfe7e950abfb80412f4c2918
SHA256:
A40D4C0285751682187667B96CDB9C2ED036FD4C275B05B07BA41E3F6C8ECFBF
Faili suurus:
12.82 KB, 12816 bytes
|
Show More
|
MD5:
9d99e2bb05e6983e4c9d8d0d1384b29f
SHA1:
bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6
SHA256:
7169C12461282FFD238DFAC0908F48680E479894187A64D0EA574FBA900FA8AA
Faili suurus:
103.84 KB, 103840 bytes
|
|
MD5:
4cacef2c307a98bb584b065485f6419d
SHA1:
0624e96b1303911965f4857b146f75d2965a0fe2
SHA256:
FAF7AB545E70A97E5BCC3C58A98962D27C91AA96E8AE0994CF27AD5E5D964917
Faili suurus:
12.82 KB, 12816 bytes
|
|
MD5:
421111e2e972c2dc02509565dfe58b9a
SHA1:
0ca767ac8acb598cdedd6ad711234ab74f68389c
SHA256:
7016BD65896DA09D15CDA98C974D9F7AEA9F7A1EC1B8BA89BBA6B6E024DCE6E9
Faili suurus:
104.35 KB, 104352 bytes
|
|
MD5:
483f9c126954a555c10f26f976a32f50
SHA1:
33eba8b9ed316a3718b90e72d37819986d249b9a
SHA256:
64EC17CF92438D0A961CC67B367E5D3F499DCD4E90A3239D81B685D18E80AD8E
Faili suurus:
3.31 MB, 3309584 bytes
|
|
MD5:
48d3eb964fd9b62572d77e98a8a6aa15
SHA1:
649e71c6405a5f4ba101c7cd50f336492d8438b3
SHA256:
40BBF1D5AE1CF313AA31467BDB51F3A7D1D412BF3A5C262D6AB481F089D887C5
Faili suurus:
12.82 KB, 12816 bytes
|
|
MD5:
dba03ab3be9f17a389166b7369e2acc4
SHA1:
57e9c9c3b26315504cddbcb43f9d54722505ec4d
SHA256:
48AC6CC9978B7F63F23D6420F76BBCAC97243D16D19C25C9D5ADCA47FBF587A3
Faili suurus:
91.66 KB, 91664 bytes
|
|
MD5:
78c66c9be1bef8db266c0dfca55640ae
SHA1:
3d7ec646ef62f1ccf613da86163db98a2cf5a856
SHA256:
55EDBBE4767D8375CE732893478CA78FAF0B3C2CE44E169AD18E55C66533B03D
Faili suurus:
4.25 MB, 4251144 bytes
|
|
MD5:
a36f5d837ad1411aadd1d051564a07b7
SHA1:
cbdaea221176488c5d69fbe8ebc869b59c4a5ab0
SHA256:
B44B6C273DA470D8BC9A6D21501CCCD7E32DA794A91F02EB2F0A7428F2F7E510
Faili suurus:
6.84 MB, 6839816 bytes
|
|
MD5:
5aa120ee57bf8dbe30e78ced9d1c7e0f
SHA1:
b60364cde63fc62fd33cd4b782926f33f7d6d126
SHA256:
9BEC78B77027742A72E215AC24775F7CC27930987333D47C60A6BD953A3F58C9
Faili suurus:
6.85 MB, 6854152 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Nimi | Väärtus |
|---|---|
| Company Name |
|
| Company Short Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Last Change |
|
| Legal Copyright |
|
| Official Build | 1 |
| Original Filename |
|
| Product Name |
|
| Product Short Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Work Product Inc. | GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1 | Self Signed |
| WORK PRODUCT, INC. | SSL.com EV Code Signing Intermediate CA RSA R3 | Self Signed |
| Chickadee Digital, LLC | Sectigo Public Code Signing Root R46 | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 16,434 |
|---|---|
| Potentially Malicious Blocks: | 1,401 |
| Whitelisted Blocks: | 9,557 |
| Unknown Blocks: | 5,476 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
x
0
0
x
?
?
0
?
?
0
?
x
?
?
?
?
?
?
?
?
?
0
?
?
0
x
0
0
x
?
?
0
0
0
0
0
x
x
x
x
x
0
?
?
0
x
0
?
?
?
0
0
0
0
x
0
0
0
0
0
x
?
?
0
?
0
x
0
?
0
?
x
?
0
0
x
0
0
0
?
?
0
x
x
x
?
?
?
x
x
0
0
0
?
?
?
?
?
x
?
0
?
0
0
0
0
0
0
0
0
?
?
?
?
x
x
?
?
0
?
0
?
0
?
0
?
0
0
?
0
?
0
0
0
?
0
0
0
?
?
x
0
0
?
?
0
0
0
0
0
?
x
x
x
?
0
0
0
?
?
?
x
?
?
?
?
0
0
0
x
x
0
0
0
0
?
0
?
?
0
0
0
?
0
0
0
0
0
0
?
?
?
?
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
?
0
?
0
?
?
?
0
?
?
0
?
?
0
?
0
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
?
?
0
0
?
0
0
0
0
?
?
0
?
?
?
?
0
0
?
?
0
0
?
?
?
0
?
?
?
0
0
0
0
?
?
?
?
0
?
?
0
0
0
0
0
?
?
0
?
?
0
0
0
0
?
0
?
?
0
?
?
?
?
?
0
?
0
?
0
?
0
0
0
?
0
?
0
?
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
0
?
?
?
?
0
0
?
0
0
0
0
0
0
0
?
0
?
?
?
?
?
?
?
?
?
0
?
0
?
?
0
?
0
?
0
0
0
?
0
?
?
?
?
0
0
?
?
0
0
0
?
?
?
?
0
?
?
?
0
0
?
0
0
0
?
?
0
?
0
0
0
?
0
0
0
0
0
?
?
0
?
0
0
?
?
?
0
?
0
?
?
?
0
0
?
?
?
0
0
?
?
0
?
?
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
0
?
x
0
?
x
0
x
0
?
0
?
?
x
0
?
?
?
x
x
x
?
?
x
x
0
?
0
?
0
?
?
?
0
x
?
0
0
x
?
x
x
0
?
0
0
0
?
0
?
0
?
?
0
?
?
?
0
0
0
0
?
0
0
x
0
0
?
?
?
?
0
0
0
?
0
?
?
0
?
0
?
0
0
?
0
?
?
0
?
0
0
?
?
?
?
0
?
0
?
0
?
?
0
?
?
?
0
0
?
0
x
x
x
0
?
0
?
?
?
0
?
?
?
?
?
?
0
?
0
?
0
?
?
0
?
0
?
0
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
?
?
0
?
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
?
0
0
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
0
?
0
0
?
?
?
0
?
?
0
0
?
0
?
?
?
?
?
?
0
0
?
?
0
0
0
0
0
0
0
?
?
0
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
0
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
0
?
0
?
?
?
?
?
?
?
0
?
0
?
0
0
?
?
0
?
?
?
0
0
?
?
0
0
0
0
?
0
?
?
0
0
0
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
0
0
0
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
0
0
?
?
?
?
0
0
?
0
0
0
0
0
?
0
?
?
?
0
?
0
0
0
0
0
x
0
0
?
?
?
0
0
0
0
?
?
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
?
?
0
?
0
?
?
?
?
?
0
?
?
?
0
0
?
?
0
?
0
?
?
?
?
0
?
0
?
0
?
0
0
0
?
?
?
?
?
?
?
?
?
0
?
?
0
0
0
?
?
?
0
?
?
?
?
?
?
?
0
?
0
0
?
0
?
?
?
?
?
?
?
?
0
0
?
?
?
?
0
?
?
0
?
?
0
0
?
0
0
?
?
0
?
?
?
0
0
0
0
0
0
?
0
0
x
?
0
?
?
?
?
0
0
0
0
?
x
0
?
?
0
?
?
?
?
?
?
?
?
?
0
0
0
0
?
?
0
?
0
0
?
?
?
0
?
0
0
0
?
0
0
0
?
?
?
1
0
0
0
0
?
0
0
0
?
?
?
0
0
0
0
0
0
?
0
?
?
0
?
0
0
0
?
0
0
?
0
0
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
0
0
?
0
?
0
0
0
0
0
?
?
?
x
?
0
?
x
x
1
?
x
0
x
0
0
0
0
?
?
0
?
x
0
x
?
x
x
x
?
0
?
?
?
?
0
?
0
0
?
0
x
x
0
0
?
?
0
?
?
0
?
x
x
x
x
0
0
0
?
0
?
x
0
?
0
0
0
0
x
x
x
0
?
0
0
?
0
0
0
0
0
x
x
x
x
x
?
?
0
x
0
0
0
0
0
0
0
x
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
x
?
?
0
?
0
0
0
x
0
x
x
0
x
0
0
x
0
x
0
x
0
0
0
x
x
x
x
?
x
?
?
?
?
?
?
?
0
?
0
0
0
0
?
0
?
0
0
0
0
x
0
?
0
0
0
0
x
0
x
0
x
0
0
?
?
0
?
0
0
0
0
0
0
0
0
x
x
x
x
x
x
0
0
x
x
x
x
x
x
0
0
x
0
?
0
?
0
?
0
0
?
0
?
?
x
x
?
?
0
0
0
0
x
?
x
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
x
?
?
?
?
?
?
0
?
0
?
?
0
?
x
0
x
?
?
?
?
?
?
0
?
0
0
0
0
0
?
x
x
x
0
0
?
?
0
x
?
?
0
?
?
?
0
?
?
0
?
?
0
0
0
x
x
0
x
x
x
0
0
x
x
0
0
0
0
0
x
x
x
x
0
0
x
0
x
x
0
x
x
x
x
0
x
x
x
0
x
x
x
0
?
?
0
?
0
0
?
0
0
0
?
0
?
0
?
?
x
0
0
?
0
0
?
0
0
x
?
?
0
x
?
x
0
0
x
0
0
x
0
0
0
0
0
0
?
0
?
0
?
x
?
0
0
?
x
0
0
0
0
0
0
?
?
?
?
?
0
?
?
?
0
0
0
0
?
0
0
0
0
?
?
?
0
?
0
?
?
x
x
0
?
0
?
x
?
?
?
?
?
x
?
?
0
?
0
?
?
?
?
?
?
0
x
x
0
0
x
0
0
?
?
x
0
?
?
?
?
x
0
?
?
0
x
x
?
x
?
0
x
0
?
x
?
x
x
0
0
0
x
0
0
x
x
0
x
0
x
x
0
0
0
?
x
?
0
0
0
x
0
x
0
?
?
0
?
0
0
0
x
x
0
0
0
?
?
?
?
?
0
0
0
?
?
?
0
0
?
0
?
?
0
?
?
x
x
x
?
0
0
?
?
0
0
?
x
x
x
x
?
?
?
?
0
0
0
0
x
0
0
0
0
0
0
0
x
x
x
x
0
0
0
0
0
0
x
0
0
0
?
x
?
0
?
?
0
?
x
0
0
x
?
x
0
0
0
0
0
0
0
0
0
0
x
0
?
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
?
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
?
0
?
0
0
0
0
0
?
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
?
?
0
0
?
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
x
x
x
0
?
0
0
0
0
0
0
x
x
?
?
0
?
0
0
?
0
0
0
0
x
0
0
0
0
0
x
0
x
0
0
?
0
0
x
0
x
0
0
?
0
?
0
?
0
0
x
0
0
0
?
x
x
0
?
0
x
0
x
0
0
0
?
x
x
0
?
0
?
0
x
?
x
?
0
x
?
0
x
0
0
x
x
x
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
x
x
0
x
?
?
?
?
?
x
?
?
?
x
0
0
x
x
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
?
0
x
0
?
x
?
?
?
?
?
?
?
?
?
x
x
x
?
x
x
0
0
x
0
0
0
?
?
0
0
0
?
?
0
0
?
?
0
x
x
0
0
x
x
0
x
x
0
x
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.AN
- Kryptik.CBX
- Kryptik.CBXA
- OneBrowser.A
- Trojan.Agent.Gen.AJG
Show More
- Trojan.Agent.Gen.APA
- Trojan.Agent.Gen.SX
- Trojan.Kryptik.Gen.COR
- Trojan.ShellcodeRunner.Gen.FF
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\72fa0ff3_obupdate.conf | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Andmed | API Name |
|---|---|---|
| HKLM\software\wow6432node\onebrowser::hb | RegNtPreCreateKey | |
| HKLM\software\wow6432node\onebrowser::72fa0ff3_installid | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Network Wininet |
|
| Anti Debug |
|
| Network Winhttp |
|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Service Control |
|
| Network Winsock2 |
|
| Network Winsock |
Show More
|
| Encryption Used |
|
| User Data Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\cde11f7d08536e148b8c70182cb66a389200f9d8_0000015368.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\76ff31a1625519f9cfe7e950abfb80412f4c2918_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6_0000103840.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0624e96b1303911965f4857b146f75d2965a0fe2_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0ca767ac8acb598cdedd6ad711234ab74f68389c_0000104352.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\649e71c6405a5f4ba101c7cd50f336492d8438b3_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57e9c9c3b26315504cddbcb43f9d54722505ec4d_0000091664.,LiQMAxHB
|
