PUP.Amonetize
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,266 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 379,462 |
| First Seen: | February 6, 2014 |
| Last Seen: | October 13, 2026 |
| OS(es) Affected: | Windows |
The detection of PUP.Amonetize on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent further problems.
Table of Contents
What Is PUP.Amonetize?
PUP.Amonetize is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on suspicious links.
How PUP.Amonetize Operates
PUP.Amonetize, like other PUPs, operates by installing itself on your system and then executing its payload. This can include displaying unwanted advertisements, collecting user data, and modifying system settings. PUPs can also install additional malware or unwanted software, which can further compromise your system's security. In some cases, PUPs can also slow down your system's performance, cause crashes, and interfere with other programs.
It is worth noting that PUPs often use deceptive tactics to install themselves on systems. They may be bundled with legitimate software, or they may be disguised as useful programs. In some cases, PUPs may even pretend to be security software, claiming to scan your system for malware and then offering to remove it for a fee.
Symptoms of Infection
If your system is infected with PUP.Amonetize, you may notice a range of symptoms. These can include unwanted advertisements popping up on your screen, slow system performance, and crashes. You may also notice that your browser settings have been changed, or that new programs have been installed without your knowledge or consent. In some cases, you may even receive fake alerts or warnings claiming that your system is infected with malware.
- Unwanted advertisements or pop-ups
- Slow system performance
- Crashes or freezes
- Changed browser settings
- New programs installed without consent
- Fake alerts or warnings
How to Remove PUP.Amonetize
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow you to download and install removal tools.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and remove any detected threats.
- Uninstall any suspicious programs that may be related to the PUP.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge.
- Reboot your system and perform another scan to ensure that the PUP has been fully removed.
Conclusion
Removing PUP.Amonetize from your system is essential to prevent further problems and protect your privacy. By following the steps outlined above, you can remove this unwanted program and restore your system to a safe and secure state. It is also important to be cautious when downloading software and to always read the terms and conditions before installing any program. By being vigilant and taking the necessary precautions, you can help protect your system from PUPs and other types of malware.
File System Details
PUP.Amonetize may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | AdmobPilotV401Crack__7934_il3770.exe | f444f83d0ace9009a19f35aa45899cfd | 38 |
| 2. | VideoScribe231Pro__7934_il55.exe | 9b4dd44cbfeeba2c0d10897849a28165 | 29 |
| 3. | DBFtoXLSExcelConverterFullDownload__7934_il1378.exe | 0a15a3675b7ec12d97747a90ccab8d00 | 19 |
| 4. | setupos_1123.exe | 30e3a418fe777bc00af856a29580a694 | 12 |
| 5. | keywordrequest__7934_il2116.exe | 67ba02a118a136e0f30e5bad0138f796 | 11 |
| 6. | P50Adjustmentresetter__7934_il3386.exe | f5a09bd79a940b227dfc7f7ef0838100 | 11 |
| 7. | PayPalMoneyAdder__7934_il7715_2.exe | 22d15884aa1b8aa766ef36fcd017d38a | 8 |
| 8. | PayPalMoneyAdder__7934_il7715.exe | 241a70673baff4fdeef513370cdce8ab | 8 |
| 9. | PayPalMoneyAdder__7934_il7715_3.exe | 46f02b4e0d007e402ca63bdc4de647cd | 8 |
| 10. | KMSpico__7934_il17.exe | 47d62242df416ff107ca324079f73b05 | 7 |
| 11. | PDFXChangeEditorPlus603181MULTIPLx86x64Portable__7934_il5451.exe | 99ce5c212ead5ef7e642507276e19cb7 | 4 |
| 12. | SteamCodesPlusHack__7934_il6.exe | f12cd52d74b476e63c31db9d10371de3 | 3 |
| 13. | iSL3ZMNMT7.exe | 05df758a2fdc54bf5ba8b4806d597478 | 3 |
| 14. | totalvpncracked__7934_il646.exe | 4dc83d433a0fcdf7f5241fd9e4401b5f | 2 |
| 15. | ApowersoftVideoDownloadCapture604SerialKeys__7934_il3930.exe | 80a7a4ab92f194133012a7c95a09b962 | 1 |
| 16. | AVSVideoConverter__7934_il4863.exe | 6ea5ed9221d1179d9702de0c2ea3bf07 | 1 |
| 17. | Doulci__7934_il6135_2.exe | 44ad39009ba6a47f3f497c372e928235 | 1 |
| 18. | Doulci__7934_il6135.exe | 9fcfc5fb057f87956f35506b10b6d7a2 | 1 |
| 19. | L550C85__7934_il724 (1).exe | 933e1a0008d0fb82456718547a762d27 | 1 |
| 20. | Spyhunter4Keygen__7934_il2600.exe | f7c1c37cea8ffed3d4876c22283a3250 | 1 |
| 21. | PokemonGoBOT__7934_il471.exe | 05675f7c9fb85f8cfc5524ab5d8439f2 | 1 |
| 22. | Emulador3dsCitra__7934_il19.exe | 4b1ddd6808c5724b437deefcb323b9f4 | 1 |
| 23. | keygen115__7934_il8.exe | d39ee046952b4baa8f007f86ab44fe2f | 1 |
| 24. | File.exe | 74ee1b7d938c0c55b17ae200b7f75df8 | 0 |
Registry Details
PUP.Amonetize may create the following registry entry or registry entries:
Regexp file mask
%TEMP%\amipixel.cfg
%TEMP%\amisetup[NUMBERS]__[NUMBERS][RANDOM CHARACTERS].exe
%TEMP%\amitest.txt
%WINDIR%\System32\Tasks\amiupdaterExd
%WINDIR%\System32\Tasks\amiupdaterExi
%WINDIR%\System32\Tasks\AmiUpdXp
%WINDIR%\Tasks\AmiUpdXp.job
SOFTWARE\Classes\dream.capture
SOFTWARE\Classes\dream.capture.1
SOFTWARE\Classes\tschmna
SOFTWARE\Classes\Updater.AmiUpd
SOFTWARE\Classes\Updater.AmiUpd.1
Software\Microsoft\wewewe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\amiupdaterExd
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\amiupdaterExi
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp
Software\Scanner_bot
SOFTWARE\Wow6432Node\Scanner_bot
Directories
PUP.Amonetize may create the following directory or directories:
| %PROGRAMFILES%\AmiExt |
| %PROGRAMFILES%\compliant host controller |
| %PROGRAMFILES%\impacts |
| %PROGRAMFILES%\sarouga |
| %PROGRAMFILES(x86)%\AmiExt |
| %PROGRAMFILES(x86)%\compliant host controller |
| %PROGRAMFILES(x86)%\impacts |
| %PROGRAMFILES(x86)%\sarouga |
Analysis Report
General information
| Family Name: | PUP.Amonetize |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
a7dce430c79adc76ef7ab68f9063e6c0
SHA1:
31d58284e53d720bd678401886f648e687c019c0
File Size:
2.43 MB, 2426543 bytes
|
|
MD5:
3224dad8dbabdc99b1e1a5de450b5f55
SHA1:
f0bd5666328795410cd4c0cac0ee810239cc0f7c
File Size:
385.02 KB, 385024 bytes
|
|
MD5:
7c054b36927690f3e9e1b12d467763fc
SHA1:
649b11c3d3fe987b247eb141bd4081d59bbf35c2
File Size:
851.46 KB, 851456 bytes
|
|
MD5:
95b831ce68f4de797fa16eec60797362
SHA1:
893dd4366bc2fcb78d7ffb766ee2cb4d37daf6f6
File Size:
911.10 KB, 911104 bytes
|
|
MD5:
106086d35a0a2ae25f16d172f8c3dd5a
SHA1:
75604403692dd907cdfe30b2af3676f3c00feedf
SHA256:
A3D65AC4B89B14D3BE3B6F54ECAB241F6DD890FB2CB38434FAE15300D19B74A5
File Size:
442.88 KB, 442880 bytes
|
Show More
|
MD5:
28ea8fe184e563fd642f751566a96bed
SHA1:
65a6f882391866e19669e7027c38fdd226d6452a
SHA256:
BFDCF1A77CEE8DE2330921ABE850BDCCACEE8A3A9E85C88E15DC0BEB2184FC13
File Size:
757.78 KB, 757776 bytes
|
|
MD5:
84846e8ad3d8c9cf7d82318f7a3f024f
SHA1:
27b828e524ae9db69ab246700a1237e8a53a022b
SHA256:
6DBACA4F30E945BEF3EED694DABB5A97F07FEB95E2261AC122CC4966855EC9BF
File Size:
712.86 KB, 712864 bytes
|
|
MD5:
a7c36f6aadaff0c642d547ece382009e
SHA1:
b47c244e1a1d4710ef4bab904881c71cb7ef30e8
SHA256:
C1BF73DE3186942C958D5280CDF3DA3659270148D4DDBF62D345203FF5657F0A
File Size:
385.02 KB, 385024 bytes
|
|
MD5:
b102668a6bdbb42c556c9f4803abd81b
SHA1:
b79c11f4a18edc49ed60cc173016815226ae192d
SHA256:
0F0E1BED29C98709DC39403DF94E64F229169C31AD0333D9BB041E3E9E27B8C3
File Size:
157.73 KB, 157728 bytes
|
|
MD5:
cd15bc7304d91fadd7db9033d6898309
SHA1:
f81790f42741a33608e0e07c18884dc8a608f434
SHA256:
25EF37FE895E2962078D9B53A11D4C59C594F00DD4F0ADBAF6CB7CA4EF68494A
File Size:
347.76 KB, 347761 bytes
|
|
MD5:
886ac6d33b5073d69cca9a25a631fbce
SHA1:
1655606611d7df45a6bc9e58ca44b17e5b650793
SHA256:
32E6F488F2CF3839F0514C8C067373AF10A8825FA45D809292E47D9DD00247A8
File Size:
44.33 KB, 44325 bytes
|
|
MD5:
ef9062ed9967d65faaf0a36a7fe182ac
SHA1:
da14c5b9357277eedfd758e65e4cf21e90a8f4cf
SHA256:
E278A9927E75DC520DA5C94E6F8A77051F9BF76B9A860ED8189CA421D439327E
File Size:
2.46 MB, 2463576 bytes
|
|
MD5:
e2c87a5ae12b845a46d0877519b0730c
SHA1:
368041d5cb06f71f1a71ed7babcf87cf5478b297
SHA256:
323276919CE39C71E5A129CA562D7B2A798B9A52F269787FA381D58EE021DC58
File Size:
883.41 KB, 883410 bytes
|
|
MD5:
5c18867bc4529ef3306c5913a2f4705b
SHA1:
6fa29da28ca8c944310b8525700f5653d68531c7
SHA256:
B897A9E6AB4E3AD94DCC39AA621AA2782F25C3E2A8AD3375FDC64B78EF63CD30
File Size:
5.34 MB, 5337088 bytes
|
|
MD5:
8661a2523c955764c8d2528741ce4896
SHA1:
028894632ec7438d6f7cb14ab4a9e1d798b8bafd
SHA256:
AE9A03CF1A34E34B81591597FE1341D2E3CE40BC838D471C25972EB484E01296
File Size:
2.22 MB, 2220907 bytes
|
|
MD5:
c8930be62a79168f3f07c0df56b9c6a8
SHA1:
7404859df31927c257b9aa02d1cc61a20df8c670
SHA256:
1D92C5B6B43FA07FE81B4E21BB950C9554C39B82E76E4FDBF3FEEB3E786C8C00
File Size:
339.50 KB, 339496 bytes
|
|
MD5:
8f89be841455b712b5be9064e6e07755
SHA1:
c2492465691e6a708b57c350333ac5475ec04b84
SHA256:
C2603CDF7FAB0DA309C9D8F7F72A476A7A4826F061834CBF5D0958D1E80A5329
File Size:
2.43 MB, 2426543 bytes
|
|
MD5:
bf7e095fcbbca60e93d1f1af69e79ccc
SHA1:
4a49b063c8c6d969e3d414b864c85930d8f6e911
SHA256:
1BCB411683915BF1CD3442D45E488F93DF53E6175A6E2E5E1FAD207443C33FF6
File Size:
2.30 MB, 2298534 bytes
|
|
MD5:
ed5bee24566c735d02239e4dc0d2c484
SHA1:
df29227bacf1c156aa567e768e4fe739b464f6fd
SHA256:
C166DDD74CAC57151F2950FA23846B50CD641E15F22280715E2A1FEA0AF06203
File Size:
44.33 KB, 44325 bytes
|
|
MD5:
19d43976e1cb1cda7b761f19a33e5943
SHA1:
706948a835af9b3a55fd2abc89b07a6daa0706da
SHA256:
BAC69E30A72169326A690538CA938AB5027DD14AD8621267519E6A1BEDF2038A
File Size:
711.29 KB, 711290 bytes
|
|
MD5:
7a9bf6966f04f8f28a379087789a8cf7
SHA1:
e0a6ee9d450a60d593221a060dedd02c3aac9e3a
SHA256:
BC58799270D8A059646E9C7B8DC27008BE8B8A6A93DAC856FEA6D7A42A314EA0
File Size:
44.33 KB, 44325 bytes
|
|
MD5:
b66517aca214128ad6a79e32b3b932e6
SHA1:
17a1cef10a984b93f6da24063958fb4e8dceac5b
SHA256:
1AAD1462D5B01CD27A9A77EC4A3A5543EA198F8E6A914D5CE7FA40E79C28DAD7
File Size:
2.43 MB, 2426543 bytes
|
|
MD5:
f32b15c82d1dcee3ccf0d5425b9a7cd2
SHA1:
c1cab83df0e5c46e8fe51af63dd7bf42d7566d84
SHA256:
F0A997C89548D76DB2D0F94CE954CB461D1FE386B0010B56B1121C4C0AA3D57E
File Size:
697.86 KB, 697856 bytes
|
|
MD5:
2df73a7c5ea21cb27256a3ceecc7d81d
SHA1:
df1f9832b7adff295563fdc3e42ed90209efd3d4
SHA256:
059BE8F45F3F04E2B95720A0543A3C37872DF9AB65DC8CB14B3A778057224E5E
File Size:
189.49 KB, 189490 bytes
|
|
MD5:
273638bdaa6d78e89e75d8a19561f541
SHA1:
69351abad564062ca6a9f8159d0c893d809fcb2a
SHA256:
EC96272CAF7989A4778F3C8DD63C3FC718F4D1EEC3F1A8679E5F8627D791E2A9
File Size:
547.46 KB, 547464 bytes
|
|
MD5:
2f216ee715f011baef23ab91a4e9f5a1
SHA1:
90d3041c86e4f6e8948210aaab3835902b9b6059
SHA256:
2EB012269336098869568B147AF159998876395AA72759B23BDB5DE5958BC2F4
File Size:
44.33 KB, 44325 bytes
|
|
MD5:
19a4de62829bd6f9d307cdfc88f9946f
SHA1:
69bb7c000311e549adf6c67105df62eee6d6b7cc
SHA256:
BF24E263F8012DEA8403402C90351BEDEC8CC9C4E528D372C67DE495C8F853C1
File Size:
653.82 KB, 653824 bytes
|
|
MD5:
08a1fd0966b0e8d97cf4c0450d77d269
SHA1:
11996289018b93b447b87a9b2adb539dc44d808c
SHA256:
8FDD059C8FFA0CDE46E8845661DB0F79B27B8460844CF64A544FE221F9624AC7
File Size:
288.96 KB, 288956 bytes
|
|
MD5:
c6b0dcb24c936d964f0563d4b15570a7
SHA1:
47b48e16c1075e894385fdf6b88db609324cdeeb
SHA256:
03C9A59B44EE5A653E519A69633F8A4377BCE91D8381603A5A1A64742AFD2ED0
File Size:
7.40 MB, 7404922 bytes
|
|
MD5:
6f9f4bb4f152108050bff88be95b0fd2
SHA1:
1783189973bb686da796e1f9f49e6b4eed1fb4b2
SHA256:
0E75B319EBA7A833869059769262CC8A22FCE14BF7E6463C4A7109E2C655903F
File Size:
768.34 KB, 768336 bytes
|
|
MD5:
bc83c3242d20db17a5d7eca60a361420
SHA1:
00aa4e8ad1394e34eb8c621f1fba83f0fe93fb0b
SHA256:
E073D0527CCF8BE69E8CB1EEB3F8EAAAFDD126B6A9AFADCA285410F300FA850B
File Size:
3.22 MB, 3219456 bytes
|
|
MD5:
6b1f48e493db2a1e48a5e5e4ffe06211
SHA1:
c3459109107e858afe68b283dd67956980078043
SHA256:
73B29548416C08FDCA5271CC5E8C322AD687D1C0F27E7ED8A0D4EBB7FECFE8A9
File Size:
153.12 KB, 153120 bytes
|
|
MD5:
44eafefc60503a6462a9738243463b7a
SHA1:
28e66811e4b4614ef86ce25baaaf8ada610fe0b0
SHA256:
A6B2BCD61AD647E4DA2D360761C710E33A12BFAD86B24C8AB2B3538DDACAACA2
File Size:
1.53 MB, 1527824 bytes
|
|
MD5:
20fe6c308eb895be21e2985def9c7f39
SHA1:
812a3f554b3285c7248d35df8e2614fe742add2f
SHA256:
A4280B77FB2D6A586A47B6AD9740ACCED6C2BE3B194A425A3554586B9EEAFFAA
File Size:
866.01 KB, 866008 bytes
|
|
MD5:
b1ab14e2014c5e5095af7748f20c0b87
SHA1:
c911804477642251fecbbc7554e79eae1d83c58b
SHA256:
D01DA88C29024CB02DE1C9D0CE381D239DA533442F832D6146C1A225BE83F4E1
File Size:
347.15 KB, 347149 bytes
|
|
MD5:
aec6310461e3d6f342645e77b5ebe9ae
SHA1:
11867386cd44dea12a9eec44bfb2c08b98f51ede
SHA256:
450B6871B7080C089ABD5FA197885B1E3E472C342B40893DCDDB2818BC545ED3
File Size:
44.33 KB, 44325 bytes
|
|
MD5:
e6d92c6a5417d1e322e7ba97b181d871
SHA1:
4dbae8aee8be9c468949959a12cc4a73a7485835
SHA256:
FD13E34542C2BE34C54A6361F871DA7D6A8F0D30A5C936D6BE1A99DD4EE0AFAD
File Size:
578.75 KB, 578752 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
Show More
|
| Legal Trademarks | Setup Factory is a trademark of Indigo Rose Corporation. |
| Original Filename |
|
| Product Name |
Show More
|
| Product Version |
Show More
|
| Program I D | com.embarcadero.install_services |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| LLC "HALKON PLYUS" | COMODO RSA Certification Authority | Root Not Trusted |
| BERSHNET LLC | COMODO RSA Code Signing CA | Self Signed |
| LLC "TELE-SERVIS" | COMODO RSA Code Signing CA | Self Signed |
| LLC "TRUKONF SOFT" | COMODO RSA Code Signing CA | Self Signed |
| Neibdh Eface | Neibdh Eface | Self Signed |
Show More
| Amonetize ltd. | Thawte Code Signing CA - G2 | Self Signed |
| Wilmaonline LTD. | Thawte Code Signing CA - G2 | Self Signed |
| octecnologia_SPC | octecnologia_SPC | Self Signed |
File Traits
- .NET
- .sdata
- 2+ executable sections
- big overlay
- dll
- Gentee
- HighEntropy
- Inno
- InnoSetup Installer
- Installer Manifest
Show More
- Installer Version
- nosig nsis
- No Version Info
- Nullsoft Installer
- packed
- SUF
- VirtualQueryEx
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,501 |
|---|---|
| Potentially Malicious Blocks: | 273 |
| Whitelisted Blocks: | 2,163 |
| Unknown Blocks: | 65 |
Visual Map
x
x
0
x
x
x
x
?
?
x
x
x
x
x
x
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
x
x
0
x
x
0
?
?
?
?
0
0
0
x
0
?
?
x
x
x
?
x
x
?
?
x
x
x
x
x
x
?
x
x
0
0
x
0
0
0
x
x
x
x
x
x
x
?
?
x
x
x
x
x
0
x
x
x
x
0
x
?
?
x
x
x
x
x
x
x
0
x
?
?
x
x
0
x
x
x
x
x
?
?
?
0
?
x
x
?
?
x
x
?
x
0
x
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
?
?
x
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
?
0
0
?
?
0
0
0
0
0
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
?
?
?
x
x
x
x
x
0
x
x
0
x
?
?
0
0
x
x
x
?
?
0
?
?
0
x
0
0
x
x
?
0
0
0
0
?
?
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
x
x
0
0
0
0
0
0
x
x
0
0
x
x
x
0
0
x
x
x
0
?
?
?
x
0
?
x
x
x
0
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
0
x
x
?
0
x
x
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
x
x
0
0
0
0
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
?
0
x
?
?
?
0
?
x
x
?
0
0
0
?
x
x
?
x
x
x
x
?
x
?
?
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
?
x
x
0
x
0
x
0
x
x
x
0
x
x
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
1
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
1
1
1
0
1
2
0
0
0
1
0
1
0
0
0
0
0
0
0
1
0
1
0
1
0
1
0
0
0
1
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
1
0
1
1
0
0
1
1
1
0
0
0
0
0
0
0
0
0
0
1
1
3
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
2
3
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
2
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Amonetize.FA
- Banker.GN
- Casbaneiro.A
- Delf.OF
- Dropper.Delf.C
Show More
- Dropper.Delf.CF
- Gamehack.ODB
- Injector.AJA
- Injector.KPD
- Kryptik.KPG
- Lotok.V
- MSIL.Agent.FQ
- MSIL.Agent.XX
- MSIL.Downloader.CPB
- MSIL.Downloader.XL
- MSIL.Dropper.HG
- MSIL.Dropper.X
- MSIL.Spy.Agent.XC
- Morto.B
- Ousaban.C
- Sheloader.A
- Shopperz.B
- Softcnapp.N
- Ulise.BE
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\program files (x86)\common files\config\data.xml | Generic Write,Read Attributes |
| c:\program files (x86)\common files\config\uninstinethnfd.exe | Generic Write,Read Attributes |
| c:\program files (x86)\common files\config\ver.xml | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\_ir_sf_temp_0\irsetup.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\_ir_sf_temp_0\irsetup.dat | Synchronize,Write Attributes |
Show More
| c:\users\user\appdata\local\temp\_ir_sf_temp_0\irsetup.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\_ir_sf_temp_0\irzip.lmd | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\_ir_sf_temp_0\lua5.1.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsabc22.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsdaaf1.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nse2087.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nse2087.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse2087.tmp\nsexec.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nse2087.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse2087.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\6suigaxrcxe.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\dcryptdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\jjfkqqbfc.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\kff6tohvq.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\khmg2rbsfy.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\kwvvrgbc7.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\lzma.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsha803.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi219a.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi219a.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm2d53.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsm2d53.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm2d53.tmp\nsexec.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsm2d53.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm2d53.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsm9c00.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nspfa03.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsq2c86.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsqbbe4.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsqbd1c.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nssa9c8.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nst1f9b.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsubb18.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsvfabf.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsw9b06.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsxa824.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsxa824.tmp\urgqnxxhu.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~nsu.tmp\au_.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\charles.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\c1cab83df0e5c46e8fe51af63dd7bf42d7566d84_0000697856 | Generic Read,Write Attributes |
| c:\users\user\downloads\c1cab83df0e5c46e8fe51af63dd7bf42d7566d84_0000697856 | Synchronize,Write Attributes |
| c:\users\user\downloads\¼ãö¼ãö( | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\windows\system32\drivers\nethfdrv.sys | Generic Write,Read Attributes |
| c:\windows\syswow64\hfnapi.dll | Generic Write,Read Attributes |
| c:\windows\syswow64\hfpapi.dll | Generic Write,Read Attributes |
| c:\windows\syswow64\installd.exe | Generic Write,Read Attributes |
| c:\windows\syswow64\nethtsrv.exe | Generic Write,Read Attributes |
| c:\windows\syswow64\netupdsrv.exe | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\classes\amibs.installer.1:: | Installer Class | RegNtPreCreateKey |
| HKLM\software\classes\amibs.installer.1\clsid:: | {A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4} | RegNtPreCreateKey |
| HKLM\software\classes\amibs.installer:: | Installer Class | RegNtPreCreateKey |
| HKLM\software\classes\amibs.installer\curver:: | AmiBs.Installer.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}:: | Installer Class | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\progid:: | AmiBs.Installer.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\versionindependentprogid:: | AmiBs.Installer | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32:: | "c:\users\user\downloads\b79c11f4a18edc49ed60cc173016815226ae192d_0000157728" | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32::serverexecutable | c:\users\user\downloads\b79c11f4a18edc49ed60cc173016815226ae192d_0000157728 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\typelib:: | {1C1356DA-1E98-4810-A9F6-18D89BD1C0C0} | RegNtPreCreateKey |
Show More
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\version:: | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0:: | InstallerLib | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0\flags:: | 0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0\0\win32:: | c:\users\user\downloads\b79c11f4a18edc49ed60cc173016815226ae192d_0000157728 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0\helpdir:: | c:\users\user\downloads | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}:: | IBoot | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\typelib:: | {1C1356DA-1E98-4810-A9F6-18D89BD1C0C0} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}:: | IBoot | RegNtPreCreateKey |
| HKLM\software\classes\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\typelib:: | {1C1356DA-1E98-4810-A9F6-18D89BD1C0C0} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{d54c859c-6066-4f31-8fe0-2aaedcae67d7}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\client::cid | � | RegNtPreCreateKey |
| HKLM\software\wow6432node\client::cname | sdAaideMweiV | RegNtPreCreateKey |
| HKLM\software\wow6432node\client::sid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\client::i | 2025091804425 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::uninstallstring | "C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe" | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::quietuninstallstring | "C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe" /S | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::displayicon | %C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::displayname | Network System Driver | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::displayversion | 1.0.0.3001 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::publisher | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::urlinfoabout | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::urlupdateinfo | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::versionmajor | 1 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::versionminor | 0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::installedby | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::nomodify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\inethnfd::norepair | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\tcpip6\parameters::disabledcomponents | | RegNtPreCreateKey |
| HKLM\system\controlset001\control\grouporderlist::pnp_tdi | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ຒ⡰ǜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\client::iv | 1892025 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᨩ༖⡰ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Tkykqoct\AppData\Local\Temp\nse2087.tmp\ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ugzwntub\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ugzwntub\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Ugzwntub\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32:: | "c:\users\user\downloads\7404859df31927c257b9aa02d1cc61a20df8c670_0000339496" | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32::serverexecutable | c:\users\user\downloads\7404859df31927c257b9aa02d1cc61a20df8c670_0000339496 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0\0\win32:: | c:\users\user\downloads\7404859df31927c257b9aa02d1cc61a20df8c670_0000339496 | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\software\policies\google\update::updatedefault | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\software\classes\amidship.hydrops.1:: | Inst Class | RegNtPreCreateKey |
| HKLM\software\classes\amidship.hydrops.1\clsid:: | {b70850b6-7d88-4326-bf0c-9d6420971c4a} | RegNtPreCreateKey |
| HKLM\software\classes\amidship.hydrops:: | Inst Class | RegNtPreCreateKey |
| HKLM\software\classes\amidship.hydrops\curver:: | amidship.hydrops.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}:: | Inst Class | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\progid:: | amidship.hydrops.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\versionindependentprogid:: | amidship.hydrops | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\localserver32:: | "c:\users\user\downloads\c1cab83df0e5c46e8fe51af63dd7bf42d7566d84_0000697856" | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\localserver32::serverexecutable | c:\users\user\downloads\c1cab83df0e5c46e8fe51af63dd7bf42d7566d84_0000697856 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\typelib:: | {e8aedbb3-ca7d-4705-b569-be63035e333e} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{b70850b6-7d88-4326-bf0c-9d6420971c4a}\version:: | 1.0 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k � 1�B �� �6 �v �� 7� �� ��� T�B� ����� 1���%�� Bx �< �� �! �R �7#��$�� %�&� '�'�!(�(X�(�) ;*J*9*�"*�h+��,=� 1`1�1HO 4.�5,]5�G>�� @V� @�*A��B B�� E�mF Fy� G�IH[uH�p | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䐃퉿迯ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꎛ蹣늋ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 笒逡늋ǜ | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32:: | "c:\users\user\downloads\c3459109107e858afe68b283dd67956980078043_0000153120" | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a6feed89-3bcd-4d19-9dc2-3e613a80a2a4}\localserver32::serverexecutable | c:\users\user\downloads\c3459109107e858afe68b283dd67956980078043_0000153120 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1c1356da-1e98-4810-a9f6-18d89bd1c0c0}\1.0\0\win32:: | c:\users\user\downloads\c3459109107e858afe68b283dd67956980078043_0000153120 | RegNtPreCreateKey |
| HKLM\software\wow6432node\client::i | & ( | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 拃廿厰ǝ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 径厰ǝ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l �v��(�1�1HO @V� A���P� ��� �$�8���&M � B1_ `�V��� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l �v��(�1�1HO @V� A���P� ��� �$�8���&M � B1_ `�V�R� ��� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Anti Debug |
|
| Syscall Use |
Show More
113 additional items are not displayed above. |
| Network Info Queried |
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
| Service Control |
|
| Process Terminate |
|
| Network Winhttp |
|
| Other Suspicious |
|
| Keyboard Access |
|
| Network Winsock2 |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
net stop nethttpservice
|
"C:\WINDOWS\system32\nethtsrv.exe" -nfdr
|
net stop serviceupdater
|
"C:\WINDOWS\system32\netupdsrv.exe" -nfdr
|
"C:\WINDOWS\system32\installd.exe" nethfdrv
|
Show More
"C:\WINDOWS\system32\nethtsrv.exe" -nfdi
|
"C:\WINDOWS\system32\netupdsrv.exe" -nfdi
|
net start nethttpservice
|
net start serviceupdater
|
"C:\Users\Ugzwntub\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
c:\users\user\downloads\nicVision_srv.exe /install /silent
|
c:\users\user\downloads\nicVision_mnt.exe /install /silent
|
c:\users\user\downloads\Windows_nv_mnt.exe /install /silent
|
open C:\Users\Ggpwxqij\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe __IRAOFF:2102130 "__IRAFN:c:\users\user\downloads\4a49b063c8c6d969e3d414b864c85930d8f6e911_0002298534" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-3119368278-1123331430-659265220-1001"
|
"C:\Users\Lwzpabwg\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
C:\Users\user\AppData\Roaming\Charles.exe
|
schtasks /Delete /TN GoogleUpdateTaskMachineCore /F
|
(NULL) schtasks /Delete /TN GoogleUpdateTaskMachineCore /F
|
"C:\Users\Aecchzeb\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Tprxxkjm\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
|
"C:\Users\Rrnlkwow\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Bvscsfgc\AppData\Local\Temp\nshA803.tmp\lzma.exe" "d" "C:\Users\Bvscsfgc\AppData\Local\Temp\nshA803.tmp\6suiGaXrcXe.dat" "C:\Users\Bvscsfgc\AppData\Local\Temp\nsxA824.tmp\URGqnXxHu.exe"
|
"C:\Users\Bvscsfgc\AppData\Local\Temp\nshA803.tmp\lzma.exe" "d" "C:\Users\Bvscsfgc\AppData\Local\Temp\nshA803.tmp\KWVvRGbc7.dat" "C:\Users\Bvscsfgc\AppData\Local\Temp\nsxA824.tmp\CommonsDll.dll"
|
"C:\Users\Kxnrhcro\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
