PUP.DotSetupIo.B
Table of Contents
Analysis Report
General information
| Family Name: | PUP.DotSetupIo.B |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
275f40f80c3fd26a4f3131f900d25882
SHA1:
98ffd0b1c44d01769fa5bc58d675082645ad95db
SHA256:
2B9A9E741635FDB78E241D3EB1CECDA72FFFD25E4C469744B029163E4F87C3F6
File Size:
5.19 MB, 5193216 bytes
|
|
MD5:
096755205f550bf8c2ea9d3993f2fbd7
SHA1:
4e6d6a1c45c78bebed0c9d0415b783ddc6e5cadc
SHA256:
0B4974ECF035E9836006CDF8C627D534C298331E6BE8B1B9101D0333CAF3F12F
File Size:
3.41 MB, 3412480 bytes
|
|
MD5:
0d81cf13636a8f44b34d555bfb9af66d
SHA1:
d2d1338d15c8a4c23ba59b8e1bda1de53aa725f8
SHA256:
BAF416C34A3E5CA356FB273EE3DB7125D6B7A6996AFF914BBA735714AEAFA6F9
File Size:
3.45 MB, 3445350 bytes
|
|
MD5:
b91d3309320ce95830f2343ef60e5ebf
SHA1:
25feee95f595bf40104a76762678750e6d901466
SHA256:
AE20DB6F59E52BD9E230C5BE475C10E6CB1CCB85F7DEE5877096F2FE5BB4F1FE
File Size:
1.32 MB, 1324842 bytes
|
|
MD5:
66f00c9860e7268af684992cdbf44c43
SHA1:
045619e511b8ab4220f604d01d3aae49f688d698
SHA256:
735ED7ADCD9CCF0895B86BFA21AA076F3F38B893353AF23F6CE4EF588861A307
File Size:
5.70 MB, 5703304 bytes
|
Show More
|
MD5:
f831569de15275d1a5fdbd339f62288f
SHA1:
acbd06d419604291ebf78d46de7e631a9fb6aeae
SHA256:
4C870B9D41C4398718B65CCD24569F91CA1F1AA704813D70547E377864C52DCD
File Size:
30.21 KB, 30208 bytes
|
|
MD5:
6a8d93136a6b75d697c1e2ed4ca5388d
SHA1:
0154d616892c42a7aacb2723a89d60675848c706
SHA256:
7128BC6068960D274D6C567A5FFB57CBE4F33CB5C26791B1AF700D1197AD4FDA
File Size:
5.58 MB, 5584312 bytes
|
|
MD5:
89eedc713f8bd7ebf622468d105369e8
SHA1:
95cdd4e5e947224712f195e3077cb1ada2983b63
SHA256:
4F30ADDCFD80FE5F69C7576C4EBA4E61348E49496CAC240CA45ACAA2124ED7CF
File Size:
2.47 MB, 2469342 bytes
|
|
MD5:
f6eee67ea08ce33e62c85380964e0f01
SHA1:
1df0b4a6d94e8866a059973415bb73c9b4db6a18
SHA256:
D0CA8255563004A4AE36F2C55741346CD69A2A257D8E530113CDED9E108B2FB6
File Size:
4.56 MB, 4555264 bytes
|
|
MD5:
62446320089113b10b86c0e78c71507a
SHA1:
b8e01b0f938529ad6bfe3ffabd55c96a883470ca
SHA256:
105BC76AC37570568AAC5D1A4007FD24ED2C3176BB25866B2658C4A59FC882FD
File Size:
5.73 MB, 5733888 bytes
|
|
MD5:
cce60c46d6ee3842e8e6f1ae28435253
SHA1:
b43a6be072f6580cba08a49122ae8dbae5c63107
SHA256:
507E4E227BDB122508F2A06162493DC25D379DC5990D0C5493E66DF66E3B6C09
File Size:
5.48 MB, 5476811 bytes
|
|
MD5:
1fa120f2cf49c753b744802abff7dd57
SHA1:
f4d0e806f492ed3a242c0f1999ecb5e38afa581c
SHA256:
E7E804E29288831A0DDCE2F5B880A428A4D63B42F335992A2FBC30A5270E0669
File Size:
3.60 MB, 3602623 bytes
|
|
MD5:
6f48a018a9ae34328ebd17af32f57fb6
SHA1:
9a28c08e996992f6077db8854df8955e6552983d
SHA256:
FA4070D779E1D3539620FA5E2C95072196A096E730D19905F0055193AAF55D13
File Size:
5.55 MB, 5551125 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 0.0.0.0 |
| Comments | SDKx86 |
| Company Name | Power Software Ltd |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Shanghai Chang Zhi Network Technology Co,. Ltd. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
| Shanghai Chang Zhi Network Technology Co,. Ltd. | DigiCert Trusted Root G4 | Hash Mismatch |
| Power Software Limited | SSL.com Code Signing Intermediate CA RSA R1 | Hash Mismatch |
| Power Software Limited | SSL.com Code Signing Intermediate CA RSA R1 | Hash Mismatch |
| Power Software Limited | SSL.com Code Signing Intermediate CA RSA R1 | Self Signed |
File Traits
- .NET
- dll
- Installer Version
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- DNDownloader.A
- DotSetupIo.B
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c: | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files\common files\system\symsrv.dll | Generic Write,Read Attributes |
| c:\program files\common files\system\symsrv.dll.000 | Generic Write,Read Attributes |
| c:\programdata\synaptics | Synchronize,Write Attributes |
| c:\programdata\synaptics\rcxa93f.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\synaptics.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Attributes |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\mncgx5k.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsd9bda.tmp\nsl9c39.tmp | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\nsd9bda.tmp\nsl9c39.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsd9bda.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgf963.tmp\nsof9b2.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgf963.tmp\nsof9b2.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsgf963.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsj47e3.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsj48cd.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nslcede.tmp\nsecf2e.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nslcede.tmp\nsecf2e.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nslcede.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsndad4.tmp\nspdb13.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsndad4.tmp\nspdb13.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsndad4.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsrf943.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nswcece.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsxdac3.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsy9bba.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsz48de.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\setup\ds.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\czdownloader\log.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winsl | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winsl\l1\30\2026 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_1df0b4a6d94e8866a059973415bb73c9b4db6a18_0004555264 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_1df0b4a6d94e8866a059973415bb73c9b4db6a18_0004555264 | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\poweriso::tbinstallflag | RegNtPreCreateKey | |
| HKCU\software\poweriso::tbinstallflag2 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cpvskzav\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cpvskzav\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Cpvskzav\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver | C:\ProgramData\Synaptics\Synaptics.exe | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\lden::pcmac | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Info Queried |
|
| Keyboard Access |
|
| Other Suspicious |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
|
| Service Control |
|
| Process Manipulation Evasion |
|
| Network Winhttp |
|
| Network Wininet |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Cpvskzav\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\acbd06d419604291ebf78d46de7e631a9fb6aeae_0000030208.,LiQMAxHB
|
runas c:\users\user\downloads\._cache_1df0b4a6d94e8866a059973415bb73c9b4db6a18_0004555264
|
runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate
|
