Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.BAT.Hosts

PUP.BAT.Hosts

By CagedTech in Potentially Unwanted Programs

The detection of PUP.BAT.Hosts on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it to prevent further damage.

What Is PUP.BAT.Hosts?

PUP.BAT.Hosts is a type of malware that can modify system settings, often without the user's knowledge or consent. The name suggests that it may be related to the hosts file on your system, which is used to map hostnames to IP addresses. However, without more specific information, it's difficult to determine the exact nature of this threat. Potentially unwanted programs like PUP.BAT.Hosts can be installed on your system through various means, including bundled software, infected downloads, or exploit kits.

How PUP.BAT.Hosts Operates

PUP.BAT.Hosts, like other PUPs, can operate in various ways, depending on its intended purpose. It may display unwanted advertisements, collect user data, or modify system settings to redirect traffic to specific websites. In some cases, PUPs can also install additional malware or create backdoors for remote access. The exact operation of PUP.BAT.Hosts is unknown, but it's likely that it's designed to generate revenue for its creators or compromise system security.

Symptoms of Infection

Systems infected with PUP.BAT.Hosts may exhibit various symptoms, including slow performance, unwanted pop-ups or ads, and unexpected changes to system settings. You may also notice that your browser's homepage or search engine has been changed without your consent. In some cases, you may experience redirects to suspicious websites or see unfamiliar programs installed on your system. If you've noticed any of these symptoms, it's essential to take immediate action to remove the threat.

How to Remove PUP.BAT.Hosts

  1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.BAT.Hosts.
  3. Uninstall any suspicious programs or applications that may be related to the PUP.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the malware.
  5. Reboot your system and perform another full scan to ensure that the threat has been completely removed.

Conclusion

Removing PUP.BAT.Hosts from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above, you can help ensure that your system is free from this potentially unwanted program and prevent further damage. It's also essential to practice good security habits, such as regularly updating your operating system and software, using strong antivirus protection, and being cautious when downloading and installing new programs. By taking these precautions, you can help protect your system from future threats and maintain a safe and secure computing environment.

Analysis Report

General information

Family Name: PUP.BAT.Hosts
Signature status: No Signature

Known Samples

MD5: 523ea0370c7810f6a922131da5861a03
SHA1: 0c895f8dcec5040b30c757f2863e0ac92ad32f2d
SHA256: 39C48CE9E07598ADAE8D0D35C5BBAB3EAF57B610C9B0B3BE8F568655A558E89B
File Size: 1.45 MB, 1446785 bytes
MD5: 60d9284ac3611ee322c225214da2b2cf
SHA1: d63c9800afaa4cb520c5d22550eb3f31874a216a
SHA256: 19779CB1BE1AF4C41B55AA57AF6F2C92997DA597663F69796D1F6991E6BE3A42
File Size: 1.48 MB, 1475072 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has TLS information
  • File is 32-bit executable
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Comments This installation was built with Inno Setup.
File Description KMS-VL-ALL Setup
Product Name KMS-VL-ALL

File Traits

  • Autoit
  • HighEntropy
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 4,350
Potentially Malicious Blocks: 32
Whitelisted Blocks: 3,200
Unknown Blocks: 1,118

Visual Map

0 1 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? ? 0 0 0 0 ? 0 0 0 ? 0 ? 0 0 1 0 0 0 ? 1 ? 0 x 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 ? ? 0 0 0 0 0 0 0 1 ? 0 ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 0 0 0 1 0 0 0 ? ? 0 0 0 0 ? 0 ? ? 0 ? 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 1 0 0 ? 0 0 0 ? 0 0 ? ? 0 ? ? 0 0 ? 0 0 ? ? 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 ? 0 0 0 0 ? 0 0 0 ? ? ? ? 0 ? 1 ? 0 0 ? 0 0 ? 0 0 0 0 0 ? ? 1 ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 ? ? 0 ? ? 0 0 ? ? 0 ? ? 1 ? 1 ? 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 1 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 ? 0 0 ? 0 0 ? 1 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 0 0 0 ? 0 ? 0 ? ? 0 0 0 ? 0 0 ? 0 0 ? 0 ? 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 ? ? 0 0 1 ? 0 0 0 0 ? ? ? ? 0 0 0 ? 0 0 0 ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 ? ? 0 0 ? ? 0 ? 0 ? ? 0 ? 1 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 ? ? 0 ? 0 ? ? 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 ? 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? ? 0 ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 ? 0 0 ? ? ? 0 ? 0 ? ? ? ? 0 0 0 0 ? 0 ? ? 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 x ? ? x 0 ? x 0 x x ? 0 0 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? 0 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 ? ? 0 ? 0 0 0 ? ? ? ? ? 0 ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? 0 0 0 0 ? 0 0 0 0 ? 0 ? ? ? 0 0 ? 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 ? ? ? 0 ? 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 x 0 ? 0 ? ? 0 0 0 0 ? ? 0 0 ? 0 ? 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 1 0 ? ? ? 0 0 0 0 ? ? 0 ? ? 0 0 0 ? 0 ? 0 0 ? 0 ? 0 0 0 ? 0 0 ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? 0 ? 0 ? ? 0 0 ? 0 ? 0 ? ? 0 ? 0 ? ? 0 0 ? 0 0 0 ? ? 0 ? ? 0 0 ? 0 0 0 ? 0 0 ? 0 0 0 0 ? ? ? ? ? 0 0 ? ? 0 0 ? 0 0 0 1 0 0 0 0 ? 0 0 0 ? ? ? 0 0 0 0 ? 0 1 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 ? ? ? ? ? ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 0 ? ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 ? 0 ? ? ? 0 0 0 ? ? ? 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? ? ? 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 0 ? ? 0 ? ? 0 0 ? 0 0 0 x 0 0 x 0 0 0 ? 0 ? 0 0 ? 0 ? ? ? ? x 0 ? 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 x 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 0 0 ? ? 0 0 0 0 0 0 1 0 ? 0 0 0 0 1 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? ? 0 0 ? ? 0 0 ? 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 ? 0 0 1 0 0 0 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 ? 0 0 0 0 ? ? ? 0 ? 1 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 1 0 0 0 0 0 0 0 0 0 0 1 0 1 ? 0 ? 0 ? ? ? ? 0 0 0 ? ? ? 0 ? ? ? 0 ? 0 ? ? 0 0 0 0 0 ? 0 ? 0 0 0 0 ? ? 0 0 ? ? 0 0 ? 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 ? ? 0 0 ? ? 0 0 0 ? 0 ? 0 ? ? 0 ? 0 1 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 1 0 0 ? 0 ? 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 1 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\32-bit\vlmcsd.exe Synchronize,Write Data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\64-bit\secopatcher.dll Synchronize,Write Data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\_isetup\_isdecmp.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\_isetup\_setup64.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\check-activation-status.bak Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\cleanospp.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\convert-c2r.bak Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\fart.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\innocallback.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\keyoff.cmd Generic Write,Read Attributes
Show More
c:\users\user\appdata\local\temp\is-2kvi7.tmp\kms-vl-all.bak Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\kms38.cmd Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\kms38.txt Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\msvcr100.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\secopatcher.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\vlmcsd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-2kvi7.tmp\x64\cleanospp.exe Synchronize,Write Data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\x64\msvcr100.dll Synchronize,Write Data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\x86\keyoff.cmd Synchronize,Write Data
c:\users\user\appdata\local\temp\is-2kvi7.tmp\xpr.log Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-gskch.tmp\0c895f8dcec5040b30c757f2863e0ac92ad32f2d_0001446785.tmp Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe ������ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 䀤谝삤ǜ RegNtPreCreateKey

Windows API Usage

Category API
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
  • WriteConsole
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
Show More
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtFsControlFile
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenMutant
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenSymbolicLinkObject
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySymbolicLinkObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtTraceEvent
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtYieldExecution
  • UNKNOWN
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation
Process Terminate
  • TerminateProcess
Keyboard Access
  • GetAsyncKeyState
  • GetKeyState

Shell Command Execution

"C:\Users\Lgnbuoxd\AppData\Local\Temp\is-GSKCH.tmp\0c895f8dcec5040b30c757f2863e0ac92ad32f2d_0001446785.tmp" /SL5="$7033E,1031260,134656,c:\users\user\downloads\0c895f8dcec5040b30c757f2863e0ac92ad32f2d_0001446785"
"C:\WINDOWS\system32\cmd.exe" /C ""C:\Users\Lgnbuoxd\AppData\Local\Temp\is-2KVI7.tmp\kms38.cmd""
C:\WINDOWS\system32\cscript.exe cscript /nologo C:\WINDOWS\system32\slmgr.vbs /xpr
C:\WINDOWS\system32\findstr.exe findstr "38" xpr.log
WriteConsole: The batch file c

Related Posts

Trending

Most Viewed

Loading...