PUP.DiskCryptor.A

PUP.DiskCryptor.A is a detection for DiskCryptor, an open-source full-disk-encryption utility for Windows. DiskCryptor is not malware in itself — it is a legitimate tool — but it is flagged as a potentially unwanted program (PUP) or riskware because it has been repeatedly weaponized by cybercriminals, most notably by the Mamba ransomware operation.

This kind of detection is a caution flag rather than an accusation: if you deliberately installed DiskCryptor to encrypt your own drives, it may be doing exactly what you intended. If it appeared without your knowledge, it could be a sign that an attacker is preparing to lock you out of your own system.

What Is DiskCryptor?

DiskCryptor is free software that can encrypt entire disk partitions, including the system partition. In the hands of a legitimate user it is a privacy tool. In the hands of an attacker, the very same capability — encrypting a whole drive with a key only they control — becomes a ransomware weapon.

Why It Is Flagged as Riskware

The FBI has warned that the Mamba ransomware wraps DiskCryptor in an installer that silently encrypts a victim's drive using an attacker-chosen password and overwrites the master boot record to lock the machine at startup. Because the underlying encryption engine is a real, powerful tool, security products flag its presence so users can confirm the installation was intentional.

What to Watch For

• DiskCryptor appearing on a system where no one intentionally installed it.
• Unexpected prompts about disk encryption or a modified boot screen.
• The tool running alongside other unfamiliar programs or scripts.

Why This Detection Matters

Legitimate encryption software abused for ransomware is a growing trend because it lets attackers "live off the land" with trusted tools. Treating an unexpected DiskCryptor installation as suspicious — and confirming why it is present — can be the difference between catching an attack early and being locked out of your data.

How to Remove DiskCryptor

Because this threat runs as a file-based Windows infection, removal has two goals: stop the malicious process and delete every component it dropped, then confirm nothing was left behind to reinstall it.

Manual Steps

1. Disconnect the computer from the internet to cut the malware off from its command-and-control server.
2. Restart Windows in Safe Mode with Networking so the threat is not loaded at startup.
3. Open Task Manager and end any unfamiliar or suspicious background processes.
4. Check Settings → Apps and uninstall any program you do not recognize or did not intentionally install.
5. Review startup entries (Task Manager → Startup) and the Run registry keys for entries that point to random file names in temporary folders.
6. If you installed DiskCryptor intentionally, you can safely keep it; if not, decrypt any partitions it manages before uninstalling so you do not lose access to your data.
7. Clear temporary files to remove staging copies of the payload.

Recommended: Run a Full Malware Scan

Manual removal is difficult because modern threats hide components and can restore themselves. The most reliable way to fully remove DiskCryptor and any additional malware it may have downloaded is to scan the system with a professional, up-to-date anti-malware tool such as SpyHunter. A complete scan will detect and remove the threat's files, registry entries, and related infections, helping restore the device to a clean, secure state.

Conclusion

PUP.DiskCryptor.A highlights a legitimate encryption tool that is often misused by ransomware. Verify whether you installed it on purpose: keep it if it is yours, or remove it and scan the system with a trusted security tool if it appeared unexpectedly, since its presence may indicate a larger threat.

Analysis Report

General information

Family Name:	PUP.DiskCryptor.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 3f7f836f201a0985c9c0463b11b9e9ee SHA1: 7e1edf585758b5a5d8281ea146b102a1ae0c7ed9 SHA256: 436D7208318E14A739A4162D197DBF5D3182D5D5A47EDE14FD01A296DA22C0FC File Size: 3.01 MB, 3008113 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	http://diskcryptor.org/
File Description	DiskCryptor Setup
Product Name	DiskCryptor
Product Version	1.4.1

File Traits

• 2+ executable sections
• Inno
• InnoSetup Installer
• Installer Manifest
• Installer Version
• VirtualQueryEx
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-5n9b5.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-abgna.tmp\7e1edf585758b5a5d8281ea146b102a1ae0c7ed9_0003008113.tmp	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n �8�tXjg�8 �� �v�Z ����T�������dc�% ���5��3bBx�< ��#�#�� $kF %� &� &�-(�(X�(� )E )�`*J*9 *�" +�[,��-!R0P% 1`1�1HO1�D5,]9ߔ=�@V�A��B��G�IH[uH�pI��K��N$ N�O�`R20	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n �8�tXjg�8 �� �v�Z ����T�������dc�% ���5��3bBx�< ��#�#�� $kF %� &� &�-(�(X�(� )E )�`*J*9 *�" +�[,��-!R0P% 1`1�1HO1�D5,]9ߔ=�@V�A��B��G�IH[uH�pI��K��N$ N�O�`R20	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Zcfklmjz\AppData\Local\Temp\is-ABGNA.tmp\7e1edf585758b5a5d8281ea146b102a1ae0c7ed9_0003008113.tmp" /SL5="$E03FC,2155522,832512,c:\users\user\downloads\7e1edf585758b5a5d8281ea146b102a1ae0c7ed9_0003008113"