PUP.GreenBug.A
The detection of PUP.GreenBug.A on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is PUP.GreenBug.A?
PUP.GreenBug.A is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as harmful as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on malicious links.
How PUP.GreenBug.A Operates
PUP.GreenBug.A, like other PUPs, operates by installing itself on your system and then performing various unwanted actions. These actions can include displaying annoying advertisements, collecting your personal data, and slowing down your system's performance. PUPs can also install additional malware or unwanted software on your system, which can further compromise your security.
In general, PUPs are designed to generate revenue for their creators, often through affiliate marketing or pay-per-click advertising. They can also be used to collect sensitive information, such as browsing habits or personal data, which can be sold to third parties or used for malicious purposes.
Symptoms of Infection
If your system is infected with PUP.GreenBug.A, you may notice various symptoms, including slow system performance, annoying advertisements, and unwanted software installations. You may also notice that your browser settings have been changed, or that your search results are being redirected to unwanted websites. Additionally, you may see pop-ups or alerts warning you of fake security threats or offering to install unwanted software.
- Unwanted advertisements or pop-ups
- Slow system performance
- Unwanted software installations
- Changed browser settings
- Redirected search results
How to Remove PUP.GreenBug.A
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.GreenBug.A and any other malware that may be present.
- Uninstall any suspicious programs that may have been installed by the malware, and be cautious when installing new software to avoid bundling with unwanted programs.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any unwanted extensions or add-ons that may have been installed by the malware.
- Reboot your system and perform a follow-up scan with your anti-malware tool to ensure that the malware has been completely removed.
Conclusion
Removing PUP.GreenBug.A from your system requires careful attention to detail and a thorough understanding of the malware's behavior. By following the steps outlined above, you can help to ensure that your system is free from this potentially unwanted program and any other malware that may be present. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when clicking on links, to prevent future infections and protect your system and personal data.
Analysis Report
General information
| Family Name: | PUP.GreenBug.A |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
d26498c5ebdc09dff9f64b94356c7a98
SHA1:
46688ebe7b2b3e911e2862c7c334367e4f6b98e2
File Size:
78.06 KB, 78062 bytes
|
|
MD5:
3dbe3ba024bbbaec7e13c16a812c46b2
SHA1:
06b3059ec9934523576c1b436f12d3cb1be3ecd0
File Size:
70.17 KB, 70165 bytes
|
|
MD5:
74bb517c1c21f1dda25a21205b582a86
SHA1:
e42d0337db53b1864838e53fb0529cbe6c0b300a
SHA256:
DD3AAB7DF467D565BD3138ED736661ADCC16B95BEBE7528B54F898998A3CB219
File Size:
61.73 KB, 61734 bytes
|
|
MD5:
7039c3baff566a63d2ab072dbe43f4b8
SHA1:
4821da60d798b7f57609a3d113049c1cf5732af3
SHA256:
67B32A4908FD019BC0587F545A59E90E7D450CEA075C5F8EEE04E0BDA20F94E2
File Size:
127.14 KB, 127142 bytes
|
|
MD5:
62f5ca4a2c47378cb6e24934407cac25
SHA1:
7bcfec2b4a3acf3b64b4a9d56f1c30e815fce498
SHA256:
CA5D950F40722026B01A8A0499CCF0CAAD28319A6A862852E33133B43EB9B5AF
File Size:
61.77 KB, 61774 bytes
|
Show More
|
MD5:
f01ab737f005a921fd44f85d467ed8ab
SHA1:
93217a654088c2598c248395911af086e680b779
SHA256:
331BD4BD0625F1C8BCBA3AFEB27156DBD6E73B635E5F0AA2A5711097AF3BB7F6
File Size:
61.88 KB, 61881 bytes
|
|
MD5:
f860db3f2611dac36609670c8cdb6a21
SHA1:
02b204deac017bd45480c12da1537311f93a360b
SHA256:
A0ACA6FE1E6C424DF76D423FC4D505790ADF4D0DF81AFDE6725F19B93C0520CB
File Size:
70.15 KB, 70147 bytes
|
|
MD5:
77e4d930df257331a5939ca5d5ece20d
SHA1:
668ef96aa7d2369eb1073fc9c7d716b882d5e443
SHA256:
344C9449E8F8D5BFE8F621432B6024B092727BCD5240A5C71ADADB9F8ECADBF4
File Size:
90.29 KB, 90286 bytes
|
|
MD5:
49d2613d9b0b8b095252c79cb56ae5ea
SHA1:
a8ee18cab0a2f1872972c15b9e89cdf6c4e8e3cd
SHA256:
589226CFDD54882D234CC2D0A88BAF02571963BCDC48EAC8EEAAB27D86449783
File Size:
61.94 KB, 61942 bytes
|
|
MD5:
b6003c1cf1bcc87e452953718812c384
SHA1:
9522d73bb74a8e268ded2375854f89f5ed5a5fbe
SHA256:
D2A012BE8717229FED9706CDD34BC163C23E54DE412D5C8ABDF8BAAC781086FF
File Size:
139.47 KB, 139470 bytes
|
|
MD5:
e30ca2aff6ba88f7afb3854b0cf632e2
SHA1:
bed898e0910ff8cb7b41daabbc92ba6d3874f5b3
SHA256:
E8C3B432F24DFC343440C42244F297769B242FD9C29A173366F971ABDDCDFE84
File Size:
1.05 MB, 1049568 bytes
|
|
MD5:
3511329d59a418840bd9efa2b65f5e96
SHA1:
18bdeca7c104a415efbf407b364b5dd70515a896
SHA256:
F45053B72C6FCBDAD22A40CD68D62A6FC2BE9E86CA175B0FF6798A7128CA69B6
File Size:
2.02 MB, 2022952 bytes
|
|
MD5:
1380ba685f76409e3aeafe012d504d7d
SHA1:
8b935d5b57870ab8dd2f1135aef55f311b5771fd
SHA256:
F7CA9C1D4FB6C3D83C009D935288BB5B50AEB4E2A4CA9FF5867C94E2C2A95278
File Size:
69.79 KB, 69788 bytes
|
|
MD5:
0d203e5f7e36cc9c83e1a216485bf8f5
SHA1:
8f32a2b1218828cd3e3d5f03e6ed9517c4b11199
SHA256:
8E888CC281DBDDE758DC9D613C61E3F2B7630EF9DA316CC7F7A8E4A2E2CD0C19
File Size:
65.69 KB, 65693 bytes
|
|
MD5:
7359db8f1a2c1bca7607cfa8a59a779a
SHA1:
f25ec6fca8791c1bf841309c2898b67bc85e3a6a
SHA256:
232F18B70679C3C3741AF2B9934C1C73857BF8EBD98310F51CF326C070D6766F
File Size:
78.01 KB, 78006 bytes
|
|
MD5:
a427a465b478212c07c06141766e1cbe
SHA1:
41381031f751df9820f86427367a5ccfe984b079
SHA256:
1012BEF58F31F242FD6AB19B126F8C6AA1849710E1515305340F874889590E0B
File Size:
73.91 KB, 73913 bytes
|
|
MD5:
46baa59e576af96e78dc4322308fb3d4
SHA1:
cc7aaa8921759d915f0672562f3f4c91188044e6
SHA256:
87F99F153E4F6B00CD94F656C89EF3C93F812D3D4B786854A03551DDCBFF5C98
File Size:
127.11 KB, 127115 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Legal Copyright |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| State Zero | State Zero | Self Signed |
File Traits
- big overlay
- Installer Manifest
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 163 |
|---|---|
| Potentially Malicious Blocks: | 2 |
| Whitelisted Blocks: | 161 |
| Unknown Blocks: | 0 |
Visual Map
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c: | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\afolder\7za.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\afolder\batclen.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\afolder\nsudolc.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\i6.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\i6.f | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\i6.t | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-oj3r6.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-vbj5e.tmp\18bdeca7c104a415efbf407b364b5dd70515a896_0002022952.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is64.bat | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\is64.fil | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is64.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\wtmpd\t23284.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\wtmpd\t23284.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t15006ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t15006ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t15214ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t15214ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t20162ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t20162ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t20707ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t20707ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t30209ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t30209ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t8171sers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t8171sers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t8607sers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t8607sers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t9915sers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ytmp\t9915sers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t21954ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t21954ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t25545ers\user\downloads\.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t25545ers\user\downloads\.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t5175.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t5175.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t9775.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ztmp\t9775.exe | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ���9 �� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | �� - xy - kP~ �ރ - ���� ��^ - ۴� h }� = Vs} � kP~ 9 �)� � ��1 � �� j ��� d - B Z F e � ��1 8 �� h �n� } - e�� - e�� | RegNtPreCreateKey |
Show More
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ��� �� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | ȁ 龡^ 紘Ç 獖} ⦘· 좟Ê | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �P � �8 �� �6 �� ۀ�=��� B� O�� ���%�� �5��Bx I sb#@�#�O$kF$�� $¨%f�%�'i(�)�*9*�"*�� ,=� 1HO 1�D5,]9ߔ:�r;�4@V� @�*B&J B�� C�!FH� H�� L7� L�KLօN$N� R20R�� TzR T�� U_*`�2a$c�w | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 輂ⷺǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | �8 P xy + kP~ �ރ + ���u ��^ + ۴� @ }� ; Vs} � kP~ � ��1 | �� A ��� d + B V F e X� ��1 �� h �n� } + e�� + e�� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ��:��V� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | a� xy �ރ ��^ ��z ) Vs} kP~ ��1 : �� e �� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ݇达膷ǜ | RegNtPreCreateKey |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\ndfapi.dll,-40001 | Windows Network Diagnostics | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 谔ꛬ숭ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k � 8�tX�jg�8 �6 �v �Z xy �� T������ ���5����Bx !wz #�#��$kF%:� %`� &� (�(X�)E)�`*J*9+�[,��-!R/9� /��1`1�1HO 1�D5�09ߔ<.:>3� @V� F?G�IH[uH�pH�� I��J�� K��N$R20U5�U_*V � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | �� xy * � /�� Y� d� � � �ރ �p ��^ �o � S Vs} kP~ ��1 1 �� 7 � �� ﺃ e e�� ��1 �� h �n� i e�� r N � v | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | l � 8�tX�jg�8 �6 �v �Z xy �� T������ ���5����Bx !wz #�#��$kF%:� %`� &� (�(X�)E)�`*J*9+�[,��-!R/9� /��1`1�1HO 1�D5�09ߔ<.:>3� @V� F?G�IH[uH�pH�� I��J�� K��N$R20U5�U_*V � | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| Syscall Use |
Show More
63 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
| Keyboard Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open C:\Users\Orrmfweh\AppData\Local\Temp\ztmp\t5175.bat "c:\users\user\downloads\46688ebe7b2b3e911e2862c7c334367e4f6b98e2_0000078062.exe"
|
WriteConsole: 'IsAdmin' is not
|
WriteConsole: The system canno
|
open C:\Users\Fdiiqgls\AppData\Local\Temp\ztmp\t9775.bat "c:\users\user\downloads\06b3059ec9934523576c1b436f12d3cb1be3ecd0_0000070165.exe"
|
C:\WINDOWS\system32\fsutil.exe fsutil dirty query C:
|
Show More
\sega_rally_2\HELP\start.htm \sega_rally_2\HELP\start.htm
|
open C:\Users\Qcjrczul\AppData\Local\Temp\is64.bat
|
open C:\Users\Mdxpkfyq\AppData\Local\Temp\is64.bat
|
open C:\Users\Droruckk\AppData\Local\Temp\i6.bat
|
"C:\Users\Ctqyaxtr\AppData\Local\Temp\is-VBJ5E.tmp\18bdeca7c104a415efbf407b364b5dd70515a896_0002022952.tmp" /SL5="$40382,1164460,980992,c:\users\user\downloads\18bdeca7c104a415efbf407b364b5dd70515a896_0002022952"
|
open C:\Users\Fyoqnqvy\AppData\Local\Temp\is64.bat
|
