HubSafe

HubSafe Description

HubSafe is a spyware that states to be a parental application. HubSafe urges the affected PC user to reveal some personal information and then sends it to remote attackers. HubSafe is also able to install a web browser plugin and creates a desktop shortcut with Korean characters. HubSafe doesn't contain any harmful payload. HubSafe is can secretly update itself via the Internet and run automatically every time you boot up Windows.

Technical Information

File System Details

HubSafe creates the following file(s):
# File Name Detection Count
1 hubupdate.exe N/A
2 hubsafe.exe N/A
3 hubfilter.dll N/A
4 hssvc.exe N/A
5 hscontrol.dll N/A

Registry Details

HubSafe creates the following registry entry or registry entries:
Registry key
HKEY_LOCAL_MACHINESOFTWAREClassesHubFilter.HubBho
F5ADCBFA-D196-4720-9FCD-F7EDE518E33D
47EDACAE-B627-4A95-BBE9-A98FD3245CEF
HKEY_CURRENT_USERSoftwareLocalAppWizard-GeneratedApplicationsHubSafe
HKEY_LOCAL_MACHINESOFTWAREClassesHSControl.HSCtrl
0001E20D-F6AE-4A9F-9012-C925ED691FBB
EAECE877-9840-49D5-B887-9F73CA7A06AD
C59329B9-26F3-41b7-AE08-1B667C45D716
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunhssvc
HKEY_LOCAL_MACHINESOFTWAREClassesHubFilter.HubBho.1
05D7ACBE-13B7-4294-A5E6-9D0013D6D1A0
F0ECEE0D-B98C-4089-A49D-5525390E9C4F
HKEY_LOCAL_MACHINESOFTWAREHubCorea