PUP.InstallMonetizer
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 2,427 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 6,124 |
| First Seen: | August 8, 2013 |
| Last Seen: | October 6, 2026 |
| OS(es) Affected: | Windows |
The detection of PUP.InstallMonetizer on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It's essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.
Table of Contents
What Is PUP.InstallMonetizer?
PUP.InstallMonetizer is a type of potentially unwanted program that is designed to generate revenue for its creators by displaying unwanted advertisements, collecting user data, or installing additional unwanted software. PUPs like InstallMonetizer often infiltrate systems through bundled software downloads, infected websites, or exploits in software vulnerabilities. They can be challenging to detect and remove, as they may not exhibit overtly malicious behavior, but they can still cause significant disruptions to your system and compromise your personal data.
How PUP.InstallMonetizer Operates
Once installed, PUP.InstallMonetizer may operate in the background, collecting user data, tracking browsing habits, or displaying unwanted advertisements. It may also install additional software or toolbars, modify system settings, or create unwanted shortcuts and icons. In some cases, PUPs can also communicate with remote servers, sending sensitive information or receiving updates and instructions. The primary goal of PUP.InstallMonetizer is to generate revenue for its creators, often at the expense of the user's system performance, security, and privacy.
Symptoms of Infection
Systems infected with PUP.InstallMonetizer may exhibit a range of symptoms, including unwanted advertisements, pop-ups, and browser redirects. You may also notice slower system performance, increased CPU usage, or unusual network activity. Additionally, you may find unfamiliar programs or toolbars installed on your system, or notice that your browser settings have been modified without your consent. In some cases, PUPs can also cause system crashes, freezes, or errors, making it essential to remove the infection as soon as possible.
How to Remove PUP.InstallMonetizer
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to ensure a stable environment for removal.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
- Uninstall any suspicious programs or software that may be related to the PUP, taking care to follow the uninstallation instructions carefully.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by the PUP.
- Reboot your system and perform a follow-up scan to ensure that all components of the PUP have been removed and that your system is clean.
Conclusion
Removing PUP.InstallMonetizer from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove the PUP and prevent future infections. It's essential to remain vigilant and take proactive steps to protect your system, including keeping your software up-to-date, avoiding suspicious downloads, and using robust security software to detect and remove threats. Remember, prevention is key, and staying informed about the latest threats and security best practices can help you maintain a safe and secure computing environment.
SpyHunter Detects & Remove PUP.InstallMonetizer
File System Details
PUP.InstallMonetizer may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | Vconverto_6939.exe | f5f4ccd5ad669ce17659126218921b9e | 0 |
Analysis Report
General information
| Family Name: | PUP.InstallMonetizer |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
267ddeb23300b5cbd257deaf8bd8cfd2
SHA1:
8fc6b04af6dc7ee0dc3a8f68c84d4523d7e33dfb
File Size:
8.10 MB, 8097915 bytes
|
|
MD5:
a46f093eff358c7e513dceb34778b03d
SHA1:
90d71fe3470e19659b7827119fa8fbacd12e78a2
File Size:
2.96 MB, 2958672 bytes
|
|
MD5:
ff62f35307d633e7b55932dd3fb472f1
SHA1:
5c44f63642d45f8b52545c513b1809c60271b120
SHA256:
6DF17FB91968A526FC3D129B4990D5C0EF4401EBB04D4F9598B55D5D7F9AA90C
File Size:
100.26 KB, 100256 bytes
|
|
MD5:
0ec4bfe9dc68bf12764099ff2559bd3a
SHA1:
6c21db64547fe567a0e7609f4c0a4883624470f3
SHA256:
3B62711198BDE966422834FC74590B093E80A0F7659BB3B7CDEB222903D1DA9F
File Size:
1.14 MB, 1139296 bytes
|
|
MD5:
bad84723756fd26879a4349bc3e46115
SHA1:
1b19d54d4424cf8fe81555b74933762a0948635d
SHA256:
3B6D6903A0240F395C125D26866C6C23ACFC8EFA85195DFC2A91BF01320F2F2A
File Size:
3.09 MB, 3088816 bytes
|
Show More
|
MD5:
b9456cb24dd3415a46370dabf5ce2602
SHA1:
5c9a2e60f7519f51e315aad9a5535e5dd334bfdd
SHA256:
AD543C67F25AF3CAA6BD3C0837758518EE87A83E841DA700AC98D54E9F2631F6
File Size:
2.39 MB, 2386578 bytes
|
|
MD5:
64468fe73da1b6a259e4604a514655bc
SHA1:
f820f0c3897f2df6a0b7fff66e5830720918de3b
SHA256:
5CF996A92092D42C12841B692FF727948AEE1F680B32ADB961FD67D722A3B3E5
File Size:
2.83 MB, 2834120 bytes
|
|
MD5:
18dd5cde8e6dd160576e14c8f0703af4
SHA1:
47243e6bf5c89b995569f9ddfee4f619fa081bf8
SHA256:
F7B06FCAFD7E6C57E019298767638D89D51CAC17308C1FAEBA11187B7B4F3A92
File Size:
5.33 MB, 5325496 bytes
|
|
MD5:
582577a8ab632f86aeeb58fa09ddc48d
SHA1:
9fac0f4ff39023ba08baf99e49ce12d58955ee1a
SHA256:
2C0785750AD3369E58E57583551C9C771D2EF61065E282B5B4CF397FF337EE25
File Size:
874.16 KB, 874160 bytes
|
|
MD5:
6d0046b8e1df03cc7385995b7b06844b
SHA1:
76ea1b6bd2c5c4fff3f768f13ba5eafc6144692c
SHA256:
995A9F3BD258F8096E73C1E614F0E1574DF660F436DCCD5704D2ECA22EE4F940
File Size:
5.11 MB, 5107648 bytes
|
|
MD5:
b96644a60fdf9dff698efa5c9b0a2402
SHA1:
1020f428cf17ca77a8fb6f53ba3c9e234f72b20b
SHA256:
186E429446BEF0196F697D350A20955A079F8847C634C09C936D005FA4682600
File Size:
6.80 MB, 6796888 bytes
|
|
MD5:
83dec6124272a85db4fecd2ff79fa0f3
SHA1:
9b4a40aed3c4c92b6f7fd86438947fb8773475b1
SHA256:
A1945C647DFDF15B0C7F0A6E5DABDDA0DDC7469AAA6D4EF0DD98817A4B6FC2D6
File Size:
5.00 MB, 5000408 bytes
|
|
MD5:
786783631191a155d484366c8732438e
SHA1:
267145306a788d022fc9e26db96155c26c1f9efa
SHA256:
9101FAD363A47F2D825440DF6AFC22732A96763EC57DDE2F8044A018DDD6BFB9
File Size:
2.58 MB, 2581376 bytes
|
|
MD5:
02c9ea840121081d9c2e19dd4f0cc4d6
SHA1:
b0a92687d53d609ce9649f389b7017fcee09337d
SHA256:
65A60CDBAF7D079B94910E6817F5772C8F4DF1E181D02DB19C498BDC6DB0BB91
File Size:
588.53 KB, 588531 bytes
|
|
MD5:
fba004195669593950082b90eac38a9b
SHA1:
680187d943e171c0abd7c1c34591059d30520281
SHA256:
E793947CA3CE38DD6AF94771F8F0679A635786F3A1C7D31AE8C245FE78280E40
File Size:
177.95 KB, 177954 bytes
|
|
MD5:
fb0dea30e036646e1954b6157331e3ff
SHA1:
d5feabc83a8d78944d3d1d70c61bd6b76cdaa45a
SHA256:
E4136A9D7138C6319658D0B3EA7B1160EFEB20F0817D9B497B9A3DC5E2B5DEA2
File Size:
6.02 MB, 6021883 bytes
|
|
MD5:
eecad373212426eae7e2ea35b973e008
SHA1:
a8acaab0db40c15caf548fbff4b18ae67b4c8e3c
SHA256:
F65804378FE569B521983DD092A7E12AF0CA06E4A6A6BA5CA6A11DE3ED59F536
File Size:
376.68 KB, 376681 bytes
|
|
MD5:
77fca9b090350fe2f351fa13c0c08cb0
SHA1:
8db3ec4f5918e930b1d8510a52002c2ce05d5dcf
SHA256:
0DE6DB247B4506EC111FC73F30E1F33CE0588F3956AAEB3438772A57F5DC2915
File Size:
6.69 MB, 6686240 bytes
|
|
MD5:
e6d276227df660ce6587cebfc10ad611
SHA1:
cb55cf22fe702e87bcd94ff7aeabad6070023eb6
SHA256:
9DA539E0644DEDF9423618E4CD3998A9FB4E60A37D373D13404692C5183C2D9E
File Size:
1.45 MB, 1452205 bytes
|
|
MD5:
fac4eed99915cfc85446e120d4609b4b
SHA1:
4b0c253dde995578e3342ce35beb986ad777b113
SHA256:
97E8AA8DD00E5ADBEBBC42ECC010285C4795F7FE2A88E302CF9A0C8EA33EA28C
File Size:
2.02 MB, 2017289 bytes
|
|
MD5:
c42b1fd8af0df91348fdd48939228c05
SHA1:
ac6043cdc1088b3e70661ef57a8742c25fd003f9
SHA256:
4D1C9A9B5F7139334B248C1A9C607854BC18FC0E2743D2CA518E6A9A40098C79
File Size:
2.58 MB, 2581376 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name | TJprojMain |
| Legal Copyright |
|
| Original Filename |
|
| Product Description | Songr Setup |
| Product Name |
Show More
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Franz Josef Wechselberger | Franz Josef Wechselberger | Self Signed |
| M417 LTD. | StartCom Certification Authority | Root Not Trusted |
| SiChuan Hengyida Information Technology CO.,LTD. | StartCom Certification Authority | Root Not Trusted |
| Beijing Tsingsoft Creative Information Technology Co., Ltd. | USERTrust RSA Certification Authority | Root Not Trusted |
| MetaProducts Corporation | UTN-USERFirst-Object | Self Signed |
Show More
| T-APP LTD | UTN-USERFirst-Object | Hash Mismatch |
| Boost Software Inc | VeriSign Class 3 Code Signing 2010 CA | Self Signed |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 6,727 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 6,727 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.FDD
- Emotet.CCA
- Emotet.CDD
- Injector.AK
- Rugmi.IA
Show More
- Sheloader.A
- Sheloader.C
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\programdata\pchealthboost\pc-healthboost-setup.exe | Synchronize,Write Data |
| c:\programdata\pchealthboost\pc-healthboost-setup.exe.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\programdata\pchealthboost\pchealthboost-setup.exe | Synchronize,Write Data |
| c:\programdata\pchealthboost\pchealthboost-setup.exe.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\binsischeck654.xml | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\bitool.xxx | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-g3tt4.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-g3tt4.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\is-g3tt4.tmp\ausuninst.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-g3tt4.tmp\setup-bottomright.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-gjrgn.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-gjrgn.tmp\idp.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-gjrgn.tmp\rk_setup.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-ilsgr.tmp\76ea1b6bd2c5c4fff3f768f13ba5eafc6144692c_0005107648.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\cbstub.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\innocallback.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\istask.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-jghkv.tmp\itdownload.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-lasrk.tmp\1b19d54d4424cf8fe81555b74933762a0948635d_0003088816.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-lqna2.tmp\8db3ec4f5918e930b1d8510a52002c2ce05d5dcf_0006686240.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-nuhf8.tmp\setup.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\lm32.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsb5bed.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsb5bed.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsb5bed.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbf8fd.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nscec0a.tmp\iospecial.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nscec0a.tmp\iospecial.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nscec0a.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nscec0a.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nscec0a.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\btmimg.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\confirm.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\finish.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\installoptions.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\iswelcome.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nse871a.tmp\iswelcome.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse871a.tmp\leftimg.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf962b.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsibb14.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsibb14.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsibb14.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsibb14.tmp\installmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsibb14.tmp\installmanager.exe_deleted_ | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsj2003.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nslf897.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsp58a1.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp58a1.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp58a1.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsp58a1.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp58a1.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspb3fe.tmp\crccheck.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspb3fe.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspb3fe.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspb3fe.tmp\uac.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nspb3fe.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsqf8a7.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\btmimg.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\finish.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\leftimg.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\nsisarray.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr4391.tmp\startmenu.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsr4391.tmp\startmenu.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu963b.tmp\crccheck.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu963b.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu963b.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu963b.tmp\uac.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu963b.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\blowfish.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\blowfish.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\getversion.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\getversion.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\manlib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\manlib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\math.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\math.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\output.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\output.txt_deleted_ | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\registry.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\registry.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswbffa.tmp\userinfo.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\banner.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\nsprocess.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\uac.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nswf91d.tmp\xml.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx6a63.tmp\installoptions.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx6a63.tmp\iospecial.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsx6a63.tmp\iospecial.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx6a63.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\banner.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\findprocdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\math.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\md5dll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsy5620.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nszb3ed.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\setup.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\setup.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\75ca58072b9926f763a91f0cc2798706_645bc4a49dcdc40fe5917fa45c6d4517 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\83d863f495e7d991917b3abb3e1eb382_4d9c2c5e642faf6fa3b8098ab3241ef2 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b46811c17859ffb409cf0e904a4aa8f8 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\bad725c80f9e10846f35d039a996e4a8_88b6ae015495c1ecc395d19c1dd02894 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\75ca58072b9926f763a91f0cc2798706_645bc4a49dcdc40fe5917fa45c6d4517 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\83d863f495e7d991917b3abb3e1eb382_4d9c2c5e642faf6fa3b8098ab3241ef2 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\bad725c80f9e10846f35d039a996e4a8_88b6ae015495c1ecc395d19c1dd02894 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::left | Դ | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::top | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Network Wininet |
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
| Keyboard Access |
|
| Encryption Used |
|
| Network Info Queried |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Users\Nafrqedw\AppData\Local\Temp\lm32.exe
|
C:\Users\Nafrqedw\AppData\Local\Temp\setup.exe
|
"C:\Users\Nafrqedw\AppData\Local\Temp\is-NUHF8.tmp\setup.tmp" /SL5="$B025A,7406801,234496,C:\Users\Nafrqedw\AppData\Local\Temp\setup.exe"
|
"C:\Users\Nqfbxfoz\AppData\Local\Temp\is-LASRK.tmp\1b19d54d4424cf8fe81555b74933762a0948635d_0003088816.tmp" /SL5="$10280,2352899,780800,c:\users\user\downloads\1b19d54d4424cf8fe81555b74933762a0948635d_0003088816"
|
"C:\Users\Zbnvaerd\AppData\Local\Temp\is-ILSGR.tmp\76ea1b6bd2c5c4fff3f768f13ba5eafc6144692c_0005107648.tmp" /SL5="$4005E,4681174,129536,c:\users\user\downloads\76ea1b6bd2c5c4fff3f768f13ba5eafc6144692c_0005107648"
|
Show More
(NULL) C:\Users\Zbnvaerd\AppData\Local\Temp\is-G3TT4.tmp\AusUninst.exe FileRecovery.exe
|
"C:\Users\Iazxczjx\AppData\Local\Temp\is-LQNA2.tmp\8db3ec4f5918e930b1d8510a52002c2ce05d5dcf_0006686240.tmp" /SL5="$260128,6151861,479744,c:\users\user\downloads\8db3ec4f5918e930b1d8510a52002c2ce05d5dcf_0006686240"
|
"C:\Users\Iazxczjx\AppData\Local\Temp\is-JGHKV.tmp\CBStub.exe" /CBURL=http://www.installmonetizer.com/download.php?kIGB
|
C:\Users\Iazxczjx\AppData\Local\Temp\nsiBB14.tmp\InstallManager.exe
|
